Monthly
We need to produce JSON. Let me analyze. CVE-2026-91924: pgweb through 0.17.0, missing authorization on POST /api/connect. CWE-862 (Missing Authorization). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N → base score roughly 8.4? Let's check: CVSS 4.0 with PR:L, VC:H, VI:L, SC:H, SI:L → probably ~8.4 is plausible? Actually with PR:L and no VA/SA... Let's just take given 8.4. PR:L means authenticated (or requires some privileges). So "authenticated" is allowed since vector contains PR:L. No KEV, no POC mentioned. So "no public exploit identified at time of analysis". Hmm, but there's a GitHub issue #869 — that's a report but not necessarily public exploit code. Patch status: no fix version given; references include a GitHub issue and code at a specific commit 6b0b0244... That commit hash could be before or after fix. Hmm. The references point to routes.go and api.go at commit 6b0b0244d1aefd6971999b03481eeeaa4ec7cf55 — presumably the vulnerable code. No fix version provided. So "No vendor-released patch identified at time of analysis" — but careful, absence of data is not confirmation. Actually pgweb is at 0.17.0 "through" which suggests the latest version is vulnerable. Rule says use most specific that applies; if patch data says NOT available → "No vendor-released patch identified at time of analysis". We don't have patch data explicitly. I'll say no vendor-released patch identified in the provided intel; issue #869 referenced. Product name: "pgweb" — 1-3 words. Just "pgweb". Summary: must not start with "A vulnerability". Start with specific impact verb and product. E.g. "Missing authorization in pgweb through 0.17.0 lets anyone able to reach the web UI's connect endpoint..." Note PR:L — requires low privileges, i.e., a session/authenticated user of pgweb UI. Write original synthesis. Technical context: pgweb is a Go-based, cross-platform PostgreSQL web client/browser (sosedoff/pgweb). Connect-backend authorization (--connect-backend?
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
A local privilege-escalation flaw in Apple's operating system family lets a malicious app already running on the device obtain root privileges by exploiting a missing authorization check. Apple addressed the issue with 'additional restrictions' in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not confirmed: the issue is not in CISA KEV, no public exploit code is identified, and CISA's SSVC assessment lists exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' once root is achieved.
Stored cross-site scripting via authorization bypass in Concrete CMS 9.2.0-9.5.2 allows an authenticated content editor to inject persistent JavaScript into the HTML head element of every page served by the site. The REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) enforces only basic content-editing authorization, omitting checks for page-property, page-template, and page-type changes; the `header_extra_content` attribute is rendered unescaped site-wide. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the stored XSS payload targets all visitors including privileged reviewers, enabling session hijacking and effective privilege escalation in multi-user editorial deployments.
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
We need answer JSON only. Need synthesize. Must include all fields strings, data_quality_flags array? It says JSON array but every field plain text string? Conflict: data_quality_flags should be JSON array. We need output valid JSON object with that field as array. Need follow. Let's analyze CVE. CVE-2026-57578: DotVVM open source MVVM framework for web apps. Prior to 4.2.11, 4.3.15, 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because explicit implementations return completed tasks instead of invoking checks. Applications relying on this filter expose protected commands, view models, presenters to unauthorized requests. AuthorizeAttribute workaround. Fixed versions. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Score 9.2. CWE-862 Missing Authorization. Patch available. Reported by GitHub_M. CPE riganti:dotvvm. Tags: Authentication Bypass, Dotvvm. SSVC exploitation none, automatable no, technical impact total. ENVD affected versions. References: GHSA, commits, release tags. Need produce original synthesis. Product name: DotVVM. Summary not copy; start with impact verb and product. E.g. "Missing authorization in DotVVM's AuthorizeActionFilter silently disables access control for protected commands, view models, and presenters, allowing unauthenticated requests to invoke them in affected versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final. No exploit code or active exploitation is identified, but the flaw requires no special bypass and can be triggered remotely against applications that use the filter." Need mention actively exploited? KEV absent. POC absent. No public exploit. Technical context: AuthorizeActionFilter is action filter in DotVVM pipeline. Explicit interface implementations ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, IPresenterActionFilter.OnPresenterExecutingAsync return Task.CompletedTask, skip IAuthorizationFilter? Need mention CWE-86
Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. The vendor advisory includes working reproduction steps, and SSVC records that proof-of-concept exploitation is available and automatable, though no CISA KEV listing or EPSS score was supplied.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
Missing authorization on three License API admin endpoints in laradashboard through 1.2.2 allows any authenticated low-privileged user to read, overwrite, or delete premium module license keys without admin rights. The affected endpoints - GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove - perform no role or permission check beyond basic authentication, exposing confidential license material and enabling destructive writes. A POC reportedly exists per SSVC exploitation status; no confirmed active exploitation is recorded in CISA KEV.
We need to produce JSON. Let me analyze. CVE-2026-91924: pgweb through 0.17.0, missing authorization on POST /api/connect. CWE-862 (Missing Authorization). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N → base score roughly 8.4? Let's check: CVSS 4.0 with PR:L, VC:H, VI:L, SC:H, SI:L → probably ~8.4 is plausible? Actually with PR:L and no VA/SA... Let's just take given 8.4. PR:L means authenticated (or requires some privileges). So "authenticated" is allowed since vector contains PR:L. No KEV, no POC mentioned. So "no public exploit identified at time of analysis". Hmm, but there's a GitHub issue #869 — that's a report but not necessarily public exploit code. Patch status: no fix version given; references include a GitHub issue and code at a specific commit 6b0b0244... That commit hash could be before or after fix. Hmm. The references point to routes.go and api.go at commit 6b0b0244d1aefd6971999b03481eeeaa4ec7cf55 — presumably the vulnerable code. No fix version provided. So "No vendor-released patch identified at time of analysis" — but careful, absence of data is not confirmation. Actually pgweb is at 0.17.0 "through" which suggests the latest version is vulnerable. Rule says use most specific that applies; if patch data says NOT available → "No vendor-released patch identified at time of analysis". We don't have patch data explicitly. I'll say no vendor-released patch identified in the provided intel; issue #869 referenced. Product name: "pgweb" — 1-3 words. Just "pgweb". Summary: must not start with "A vulnerability". Start with specific impact verb and product. E.g. "Missing authorization in pgweb through 0.17.0 lets anyone able to reach the web UI's connect endpoint..." Note PR:L — requires low privileges, i.e., a session/authenticated user of pgweb UI. Write original synthesis. Technical context: pgweb is a Go-based, cross-platform PostgreSQL web client/browser (sosedoff/pgweb). Connect-backend authorization (--connect-backend?
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
A local privilege-escalation flaw in Apple's operating system family lets a malicious app already running on the device obtain root privileges by exploiting a missing authorization check. Apple addressed the issue with 'additional restrictions' in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not confirmed: the issue is not in CISA KEV, no public exploit code is identified, and CISA's SSVC assessment lists exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' once root is achieved.
Stored cross-site scripting via authorization bypass in Concrete CMS 9.2.0-9.5.2 allows an authenticated content editor to inject persistent JavaScript into the HTML head element of every page served by the site. The REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) enforces only basic content-editing authorization, omitting checks for page-property, page-template, and page-type changes; the `header_extra_content` attribute is rendered unescaped site-wide. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the stored XSS payload targets all visitors including privileged reviewers, enabling session hijacking and effective privilege escalation in multi-user editorial deployments.
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
We need answer JSON only. Need synthesize. Must include all fields strings, data_quality_flags array? It says JSON array but every field plain text string? Conflict: data_quality_flags should be JSON array. We need output valid JSON object with that field as array. Need follow. Let's analyze CVE. CVE-2026-57578: DotVVM open source MVVM framework for web apps. Prior to 4.2.11, 4.3.15, 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because explicit implementations return completed tasks instead of invoking checks. Applications relying on this filter expose protected commands, view models, presenters to unauthorized requests. AuthorizeAttribute workaround. Fixed versions. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Score 9.2. CWE-862 Missing Authorization. Patch available. Reported by GitHub_M. CPE riganti:dotvvm. Tags: Authentication Bypass, Dotvvm. SSVC exploitation none, automatable no, technical impact total. ENVD affected versions. References: GHSA, commits, release tags. Need produce original synthesis. Product name: DotVVM. Summary not copy; start with impact verb and product. E.g. "Missing authorization in DotVVM's AuthorizeActionFilter silently disables access control for protected commands, view models, and presenters, allowing unauthenticated requests to invoke them in affected versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final. No exploit code or active exploitation is identified, but the flaw requires no special bypass and can be triggered remotely against applications that use the filter." Need mention actively exploited? KEV absent. POC absent. No public exploit. Technical context: AuthorizeActionFilter is action filter in DotVVM pipeline. Explicit interface implementations ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, IPresenterActionFilter.OnPresenterExecutingAsync return Task.CompletedTask, skip IAuthorizationFilter? Need mention CWE-86
Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. The vendor advisory includes working reproduction steps, and SSVC records that proof-of-concept exploitation is available and automatable, though no CISA KEV listing or EPSS score was supplied.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
Missing authorization on three License API admin endpoints in laradashboard through 1.2.2 allows any authenticated low-privileged user to read, overwrite, or delete premium module license keys without admin rights. The affected endpoints - GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove - perform no role or permission check beyond basic authentication, exposing confidential license material and enabling destructive writes. A POC reportedly exists per SSVC exploitation status; no confirmed active exploitation is recorded in CISA KEV.