Monthly
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
WebSocket subscription handlers in Yamcs bypass the object-level authorization checks enforced by their REST API counterparts, allowing any authenticated user to subscribe to the `packets`, `algorithm-status`, and `mdb-changes` topics and receive data their role explicitly restricts. Yamcs versions up to 5.12.7 and 5.13.0-5.13.1 are affected, exposing raw telemetry packets, algorithm execution status, and mission database changes to low-privilege principals. No public exploit code has been identified and no CISA KEV listing exists, but the exploit path is structurally trivial for any credentialed user given standard WebSocket client access.
Missing function-level access control in Yamcs Core's REST API allows any authenticated user - including completely unprivileged 'Guest' accounts - to bypass the platform's RBAC system across three distinct API controllers. Affected endpoints in IndexesApi, Cop1Api, and TimeApi omit authorization checks entirely, enabling telemetry metadata exfiltration, disruption of COP-1 satellite telecommand protocols, and manipulation of global simulation time. Publicly available exploit code (curl-based PoC) confirms exploitability; the vulnerability is not currently listed in CISA KEV, though the spacecraft operations context elevates real-world impact severity.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
WebSocket subscription handlers in Yamcs bypass the object-level authorization checks enforced by their REST API counterparts, allowing any authenticated user to subscribe to the `packets`, `algorithm-status`, and `mdb-changes` topics and receive data their role explicitly restricts. Yamcs versions up to 5.12.7 and 5.13.0-5.13.1 are affected, exposing raw telemetry packets, algorithm execution status, and mission database changes to low-privilege principals. No public exploit code has been identified and no CISA KEV listing exists, but the exploit path is structurally trivial for any credentialed user given standard WebSocket client access.
Missing function-level access control in Yamcs Core's REST API allows any authenticated user - including completely unprivileged 'Guest' accounts - to bypass the platform's RBAC system across three distinct API controllers. Affected endpoints in IndexesApi, Cop1Api, and TimeApi omit authorization checks entirely, enabling telemetry metadata exfiltration, disruption of COP-1 satellite telecommand protocols, and manipulation of global simulation time. Publicly available exploit code (curl-based PoC) confirms exploitability; the vulnerability is not currently listed in CISA KEV, though the spacecraft operations context elevates real-world impact severity.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.