Monthly
Authentication bypass in Wp Social Login and Register Social Counter 3.2.2 and earlier allows an unauthenticated remote attacker to obtain a fully authenticated WordPress session as an existing user, including an administrator, when the site has the bundled Facebook or Twitter social-login provider configured and active. The plugin's social-login REST callback trusts the OAuth provider's email string and calls wp_set_auth_cookie() without a password check, while the intended email-verification guard is ineffective for the bundled Hybridauth Facebook and Twitter adapters. No public exploit is identified at time of analysis, and the provided intelligence does not confirm active exploitation, but the assessed prerequisites and high impact make this a this-week priority.
Authentication bypass in Uncanny LearnDash Toolkit 3.8.2 and earlier lets a network attacker who already knows a target account's credentials log in even when that account is pending approval, unverified, or administrator-suspended. The plugin's account gate checks the raw `email` value with `get_user_by()`, while the later `wp_signon()` call runs WordPress core's `sanitize_user()`, so appended junk causes the gate to be skipped while the real account still authenticates; the required nonce is freely obtainable from the unauthenticated `ult-refresh-nonce` endpoint. Risk signals are mixed: the supplied vector is 9.8 with PR:N and the decision label is act_now, but exploitation still requires valid credentials for an account in a gated state; no public exploit identified at time of analysis.
Cross-tenant account takeover in ROOST Coop before 1.0.2 stems from the SAML verify callback resolving the authenticated user by email only, without binding that lookup to the organization named in the /saml/login/:orgId/callback path. An attacker who administers any organization on the instance and controls its SAML IdP signing key can post an assertion for a victim's email to a different organization's callback when the target organization has registered the same signing certificate, and receive a session as that victim. The attack is authenticated (PR:H in the vendor vector, since registering a SAML IdP requires organization administrator rights) and is only exploitable in the unusual shared-certificate configuration; there is no KEV listing and no public exploit identified at time of analysis, and the decision signal places remediation in the this-week window.
Account impersonation in pgAdmin 4 server mode before 9.19 lets a user who successfully authenticates against a configured LDAP directory or Kerberos realm be logged into a different pgAdmin account that happens to share their username - including the built-in internal administrator created at first setup - inheriting that account's role, registered servers and saved database passwords. A second variant occurs when internal authentication is listed before LDAP or Kerberos in AUTHENTICATION_SOURCES: Flask-Security's internal form validation resolves the typed email to an account and retains it even though the password did not match, so a Kerberos or LDAP user can type another directory user's principal or email and be logged in as that user. Exploitation requires valid credentials for the directory or realm pgAdmin is configured to use (authenticated, PR:L) plus a username collision across sources; desktop mode and versions 9.19 and later are not affected, and no public exploit code was identified at time of analysis.
Unauthenticated attackers can install detection-suppression rules in SOCFortress CoPilot deployments before 0.1.77 because the Velociraptor Sigma exclusion endpoints never actually validate the bearer token they receive: an arbitrary, expired or forged value is decoded into a sentinel string ('Invalid token' / 'Expired signature') that is stored as the rule's creator instead of rejecting the request. A rule created with a null customer_code applies to every tenant, so matching Sigma alerts are silently dropped by process_sigma_alert before an incident is ever created, and any authenticated user down to the lowest-privilege customer_user role can additionally list, read, update, toggle and delete every exclusion because those routes carry no scope or tenant check. Version 0.1.77 fixes both paths. No confirmed active exploitation (not in CISA KEV) is reported, but the vendor advisory publishes a detailed two-step proof-of-concept reference for the unauthenticated create path that has not been independently validated here as working exploit code.
Vvveb CMS before 1.0.8.7 exposes its password-reset flow to unauthenticated account takeover: an attacker supplies a valid username and a PHP array-style token parameter (for example token[]=), and the handler accepts the reset without a legitimate token. The GitHub advisory documents reproduction steps leading to arbitrary password changes, including administrative accounts, and the vuln.today decision is act_now with a 9.8 CVSS vector (AV:N/AC:L/PR:N/UI:N). A public proof-of-concept is documented in the advisory; no CISA KEV listing is present in the supplied data.
mTLS client authentication can be silently bypassed in Traefik 3.7.0-ea.1 through 3.7.14 when the Kubernetes Ingress NGINX provider is used and a second Ingress on the same host declares a path without matching auth-tls-secret settings. With core.strictTLSOptions disabled, Traefik falls back to default TLS options that do not request a client certificate, allowing unauthenticated remote attackers to reach backends intended to require mTLS. No public exploit identified at time of analysis; exploitation requires the non-default multi-Ingress same-host configuration collision described by the vendor.
Authentication bypass in the WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal (versions before 2.191) allows anyone holding a user's current authenticator-app code to log in as that user, including an administrator, without supplying the account password. Exploitation is conditional: the site must run an affected version and the target account must use authenticator-app (TOTP) two-factor authentication, and the attacker must obtain a valid, time-limited code. No public exploit identified at time of analysis; SSVC lists exploitation as none, EPSS is 0.13% (3rd percentile), and the vendor has released version 2.191 as the fix.
Progress WS_FTP Server on Windows exposes sensitive information, including administrative credentials, to unauthenticated remote attackers because of improper authentication in releases before 2024.0.6 and before 2025.0.3. The maximum CVSS score of 10.0 and the vuln.today act_now label reflect a network-reachable, no-prerequisites authentication bypass with changed scope and high confidentiality, integrity, and availability impact; patched releases are not vulnerable. No public exploit was identified at time of analysis, and the available sources do not confirm active exploitation.
IBM Langflow OSS 1.0.0 through 1.12.8 allows unauthenticated remote attackers to bypass security restrictions through improper authentication, with a CVSS 9.8 vector indicating high confidentiality, integrity, and availability impact and no privileges or user interaction required. The vendor has published a patch and the vuln.today priority is act_now, though no public exploit was identified at the time of analysis. Network exposure is the main practical limiter, since instances behind VPNs, authentication proxies, or localhost-only access are less reachable.
Authentication bypass in Wp Social Login and Register Social Counter 3.2.2 and earlier allows an unauthenticated remote attacker to obtain a fully authenticated WordPress session as an existing user, including an administrator, when the site has the bundled Facebook or Twitter social-login provider configured and active. The plugin's social-login REST callback trusts the OAuth provider's email string and calls wp_set_auth_cookie() without a password check, while the intended email-verification guard is ineffective for the bundled Hybridauth Facebook and Twitter adapters. No public exploit is identified at time of analysis, and the provided intelligence does not confirm active exploitation, but the assessed prerequisites and high impact make this a this-week priority.
Authentication bypass in Uncanny LearnDash Toolkit 3.8.2 and earlier lets a network attacker who already knows a target account's credentials log in even when that account is pending approval, unverified, or administrator-suspended. The plugin's account gate checks the raw `email` value with `get_user_by()`, while the later `wp_signon()` call runs WordPress core's `sanitize_user()`, so appended junk causes the gate to be skipped while the real account still authenticates; the required nonce is freely obtainable from the unauthenticated `ult-refresh-nonce` endpoint. Risk signals are mixed: the supplied vector is 9.8 with PR:N and the decision label is act_now, but exploitation still requires valid credentials for an account in a gated state; no public exploit identified at time of analysis.
Cross-tenant account takeover in ROOST Coop before 1.0.2 stems from the SAML verify callback resolving the authenticated user by email only, without binding that lookup to the organization named in the /saml/login/:orgId/callback path. An attacker who administers any organization on the instance and controls its SAML IdP signing key can post an assertion for a victim's email to a different organization's callback when the target organization has registered the same signing certificate, and receive a session as that victim. The attack is authenticated (PR:H in the vendor vector, since registering a SAML IdP requires organization administrator rights) and is only exploitable in the unusual shared-certificate configuration; there is no KEV listing and no public exploit identified at time of analysis, and the decision signal places remediation in the this-week window.
Account impersonation in pgAdmin 4 server mode before 9.19 lets a user who successfully authenticates against a configured LDAP directory or Kerberos realm be logged into a different pgAdmin account that happens to share their username - including the built-in internal administrator created at first setup - inheriting that account's role, registered servers and saved database passwords. A second variant occurs when internal authentication is listed before LDAP or Kerberos in AUTHENTICATION_SOURCES: Flask-Security's internal form validation resolves the typed email to an account and retains it even though the password did not match, so a Kerberos or LDAP user can type another directory user's principal or email and be logged in as that user. Exploitation requires valid credentials for the directory or realm pgAdmin is configured to use (authenticated, PR:L) plus a username collision across sources; desktop mode and versions 9.19 and later are not affected, and no public exploit code was identified at time of analysis.
Unauthenticated attackers can install detection-suppression rules in SOCFortress CoPilot deployments before 0.1.77 because the Velociraptor Sigma exclusion endpoints never actually validate the bearer token they receive: an arbitrary, expired or forged value is decoded into a sentinel string ('Invalid token' / 'Expired signature') that is stored as the rule's creator instead of rejecting the request. A rule created with a null customer_code applies to every tenant, so matching Sigma alerts are silently dropped by process_sigma_alert before an incident is ever created, and any authenticated user down to the lowest-privilege customer_user role can additionally list, read, update, toggle and delete every exclusion because those routes carry no scope or tenant check. Version 0.1.77 fixes both paths. No confirmed active exploitation (not in CISA KEV) is reported, but the vendor advisory publishes a detailed two-step proof-of-concept reference for the unauthenticated create path that has not been independently validated here as working exploit code.
Vvveb CMS before 1.0.8.7 exposes its password-reset flow to unauthenticated account takeover: an attacker supplies a valid username and a PHP array-style token parameter (for example token[]=), and the handler accepts the reset without a legitimate token. The GitHub advisory documents reproduction steps leading to arbitrary password changes, including administrative accounts, and the vuln.today decision is act_now with a 9.8 CVSS vector (AV:N/AC:L/PR:N/UI:N). A public proof-of-concept is documented in the advisory; no CISA KEV listing is present in the supplied data.
mTLS client authentication can be silently bypassed in Traefik 3.7.0-ea.1 through 3.7.14 when the Kubernetes Ingress NGINX provider is used and a second Ingress on the same host declares a path without matching auth-tls-secret settings. With core.strictTLSOptions disabled, Traefik falls back to default TLS options that do not request a client certificate, allowing unauthenticated remote attackers to reach backends intended to require mTLS. No public exploit identified at time of analysis; exploitation requires the non-default multi-Ingress same-host configuration collision described by the vendor.
Authentication bypass in the WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal (versions before 2.191) allows anyone holding a user's current authenticator-app code to log in as that user, including an administrator, without supplying the account password. Exploitation is conditional: the site must run an affected version and the target account must use authenticator-app (TOTP) two-factor authentication, and the attacker must obtain a valid, time-limited code. No public exploit identified at time of analysis; SSVC lists exploitation as none, EPSS is 0.13% (3rd percentile), and the vendor has released version 2.191 as the fix.
Progress WS_FTP Server on Windows exposes sensitive information, including administrative credentials, to unauthenticated remote attackers because of improper authentication in releases before 2024.0.6 and before 2025.0.3. The maximum CVSS score of 10.0 and the vuln.today act_now label reflect a network-reachable, no-prerequisites authentication bypass with changed scope and high confidentiality, integrity, and availability impact; patched releases are not vulnerable. No public exploit was identified at time of analysis, and the available sources do not confirm active exploitation.
IBM Langflow OSS 1.0.0 through 1.12.8 allows unauthenticated remote attackers to bypass security restrictions through improper authentication, with a CVSS 9.8 vector indicating high confidentiality, integrity, and availability impact and no privileges or user interaction required. The vendor has published a patch and the vuln.today priority is act_now, though no public exploit was identified at the time of analysis. Network exposure is the main practical limiter, since instances behind VPNs, authentication proxies, or localhost-only access are less reachable.