Authentication Bypass
Monthly
Authorization bypass in Zalando Skipper before 0.27.37 lets unauthenticated remote attackers slip an oversized request body past an Open Policy Agent body-inspection policy: when the opaAuthorizeRequestWithBody filter truncates the body at maxBodyBytes, Skipper derives the input.truncated_body signal from Content-Length rather than the bytes actually read, so an HTTP/1.1 chunked or Content-Length-less HTTP/2 request is evaluated by OPA as non-truncated, allowed, and then forwarded in full to the protected upstream (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, CWE-863). Exploitation is gated on a non-default deployment: the filter must be active and the policy must explicitly allow requests when input.truncated_body == false, the pattern recommended as the prior mitigation for CVE-2026-50197, while installations that do not inspect bodies or do not key on truncated_body are unaffected and requests carrying an accurate Content-Length are correctly flagged as truncated and denied. No public exploit identified at time of analysis.
Unauthenticated remote attackers can read trace and funnel analytics from SigNoz deployments running versions 0.88.0 through 0.141.0 because the trace-funnel analytics HTTP handlers were registered without any authorization wrapper. A single unauthenticated POST to endpoints under the trace-funnels router (both the /{funnel_id}/analytics/* and /analytics/* payload variants) returns identifiers, durations, span counts, service topology, and error activity, and because the payload-style handlers accept attacker-supplied funnel definitions, no pre-existing funnel or account is required. Exploitation is bounded by network reachability to the query-service listener and is read-only (no modification or code execution), and no public exploit code has been identified at time of analysis.
SIMAC MyPHR 1.1 exposes an insecure direct object reference (IDOR) in its employee-update API that lets any authenticated user with a valid low-privileged account access and modify arbitrary employee records. By sending a PUT request with another employee's identifier and a controlled password value, an attacker can take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information such as private pay bulletins. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 base score of 8.7; active exploitation has not been confirmed by CISA KEV status in the provided data.
Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No public exploit code was identified at time of analysis.
Local attackers with write access to Nuclei's on-disk template storage can bypass template signature verification and cause arbitrary operating system commands to execute from a tampered template in ProjectDiscovery Nuclei versions before 3.11.1 (reported as 3.7.0 through 3.10.x). The root cause is CWE-347: cached signature-verification results were keyed only on a template file's modification time, so an attacker can swap a previously verified template for unsigned malicious content and restore the original mtime to have the stale 'verified' result reused under the default configuration where unsigned templates are disabled. The assessed attack path requires local low-privilege access (CVSS 4.0 PR:L) plus a victim operator actually running a scan against the tampered template (UI:P), so this is an access-gated supply-chain integrity flaw rather than a remotely exploitable or wormable one; no public exploit identified at time of analysis, and the vendor-released fix in 3.11.1 binds cache reuse to a content digest.
Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.
Signature forgery in Sequoia OpenPGP (sequoia-openpgp) stems from incorrect key-flag inference for legacy OpenPGP certificates that lack a key-flags subpacket, letting an unauthenticated remote attacker bypass the back-signature check and bind an arbitrary subkey to their own certificate. This compromises cryptographic integrity for any application that uses the library to verify untrusted certificates, although exploitation requires the victim to process a crafted certificate (UI:R). No public exploit code or CISA KEV entry was identified in the provided data.
Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. Impact is integrity-only (CVSS 3.1 assessed: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; vendor-published CVSS 4.0 score 7.1, VI:H), requiring only a valid low-privileged account with no admin role and no user interaction; no public exploit code was identified at time of analysis.
Improper access control in stylefeng Guns through 8.3.5 lets any authenticated user, even one with no assigned roles, create, edit, delete, publish, and retract system-wide notices via SysNoticeController actions that never require a permission. The issue is remotely exploitable with low privileges and high integrity impact but no confidentiality or availability impact; no public exploit code has been identified at time of analysis, and authentication is required (PR:L) because the attacker must already have a valid Guns session.
Missing authorization in the Guns Java rapid-development framework (through 8.3.5) allows any authenticated user to harvest the full user directory, including account names, real names, email addresses, phone numbers, last-login IPs and role assignments. The /sysUser/detail and /sysUser/page handlers in SysUserController omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them and returns data for every user in the system to anyone holding a valid login token. The attack is network-reachable and needs only a low-privileged authenticated session (PR:L), with no user interaction and no administrative rights; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied in the source data.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR methods by sending a POST to a URL their role is allowed to reach while naming a privileged class and method in the request body, bypassing Spring Security's URL-pattern-only access control; the assessed severity is CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact once the flaw is chained with the other Tenable-reported findings it enables. Exploitation is not anonymous: the attacker must already hold a valid low-privilege ScadaLTS session, and the deployment must run with DWR's crossDomainSessionSecurity setting set to false in web.xml (the default in the affected build), which disables DWR's built-in origin and session validation. No confirmed active exploitation (CISA KEV) and no public exploit code were identified in the available intelligence at time of analysis, so the practical urgency is driven by the credential precondition rather than by observed attacks.
reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. No public exploit identified at time of analysis, and successful exploitation requires an authenticated account plus configured integrations to expose meaningful secrets.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.
Authorization bypass in @fastify/auth versions 5.0.0 through 5.1.0 lets an authenticated low-privileged attacker who possesses a credential satisfying only the final member of a nested AND group, such as a valid API key without administrator rights, be authorized instead of rejected. The flaw occurs when strategies are composed with the relation "or" option together with the run "all" option and an entry is a nested array acting as an AND group, causing the group result to collapse to its last check; a mirror order-dependent bypass exists for top-level relation "and" with a nested "or" group. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the vendor-released fix is version 5.1.1 or later.
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.
Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.
Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.
Missing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one with zero assigned roles - invoke administrative APIs for user management, role assignment, password resets by user ID, and Elasticsearch index deletion, because the shipped default of zlt.security.auth.urlPermission.enable is false and suppresses all permission checks once authentication succeeds. Exploitation is not pre-auth: it requires a valid low-privilege session against a deployment running the out-of-the-box configuration, and publicly available exploit code exists (VulnCheck-reported PoC scripts covering role-granting, user enumeration, password reset, and ES index deletion), though no confirmed active exploitation (CISA KEV) has been recorded. Assessed severity is high (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8; vendor-published CVSS 4.0 score 8.7) because a zero-role user obtains both read and write access to sensitive administrative functions.
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. Impact is total: full read/write/execute control of the administrative panel, which is why the score is high (CVSS 4.0 8.7; assessed CVSS 3.1 8.7, C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor firmware 1.1.0.651412 resolves the issue.
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege operators - to read the installation-wide audit trail by calling GET /admin-api/crm/operatelog/page, exposing operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. Publicly available exploit code exists (a PoC script that queries the endpoint), and although exploitation requires a valid back-office session with network reach to the admin API, no elevated role or user interaction is needed, so the realistic threat is a malicious insider or anyone who has reused or stolen an operator credential. The vulnerability is broken access control (CWE-862) with high confidentiality impact only; it does not permit data modification, service disruption, or pre-authentication compromise.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales leads belonging to other employees by invoking the CrmCluesController receiveCustomer lead-claim endpoint with a manipulated ownerUserId value. The flaw is a broken access control (CWE-862) issue that requires only a valid low-privilege staff login and no administrative role, feature toggle, or user interaction, with the practical impact limited to integrity of lead ownership data (no confidentiality or availability impact). Publicly available exploit code exists in the form of a Python proof-of-concept targeting the endpoint, and the absence of access logging or quota validation on the operation removes any built-in brake on bulk lead theft, though no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privilege level, invoke the saveRedisSet and getRedisSet endpoints in CrmCustomerController and rewrite the installation-wide Redis keys that drive lead allocation and customer auto-recycling. Because the scheduled CustomerAutoJob consumes those same keys, a low-privilege staff account can disable recycling, block customer creation, or trigger mass customer deletion across the deployment; publicly available exploit code exists (the VulnCheck-referenced CVE request PoC on GitHub), while no active exploitation has been confirmed and the CVE is not listed in CISA KEV. This is a genuine but bounded-priority issue: exploitation requires a valid CRM account (assessed CVSS PR:L, so unauthenticated remote abuse is not possible), and the assessed impact is high integrity loss to shared policy state (I:H) with a limited availability effect (A:L) and no confidentiality loss (C:N - the readable values are configuration/policy keys, not customer records).
Wild-pointer dereference in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets an unexpected STATUS_TYPE completion IOCB reach a SCSI-only fast path, where the srb union is reinterpreted so sp->u.scmd.cmd reads as a non-NULL garbage pointer and is dereferenced. Only hosts running the qla2xxx driver with a physical QLogic FC HBA are exposed, and only when the adapter firmware or FC fabric delivers a mis-typed status IOCB that coincides with a live non-SCSI outstanding handle; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, so the realistic outcome is a kernel crash rather than reliable code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor patches are available for all maintained stable branches.
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Unauthenticated remote access to the configuration download function on XikeStor Layer3 switches (SKS8300-8T, SKS8300-12E2T2X, SKS8310-8X) running firmware below V1.04.B09 exposes full device configuration files to any network-reachable attacker. Recovered configurations contain network topology details and credentials, enabling attackers to authenticate to the switch itself or leverage it as a pivot point into the protected network segment it manages. Disclosed by JPCERT/CC (JVN#45281119); no public exploit code or active exploitation (CISA KEV) identified at time of analysis.
Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.
Let me synthesize. Product: Arista EOS. Key data: CVSS 4.0 vector: AV:A (adjacent), AC:H, AT:P (attack requirements present), PR:N, UI:N, VC:N, VI:N, VA:H, SC:N, SI:N, SA:H. CVSS score 7.0. CWE-863 (Incorrect Authorization) — hmm, that's a bit odd for a malformed packet handling issue; likely a mismatch worth flagging in confidence notes. Tags: "Authentication Bypass" — that seems mislabeled; the description is about malformed IS-IS LSP PDU causing graceful restart procedure termination — an availability issue, not auth bypass. Also CWE-863 mismatch. I could emit a data_quality_flag mislabeled_tag "Authentication Bypass". Hmm — is that highly confident? The description says unauthenticated attacker, but it's not authentication bypass — it's a protocol-level denial of service. CWE-863 incorrect authorization. The tag "Authentication Bypass" is arguably wrong. I think it's defensible to flag as mislabeled_tag with medium/high confidence. Let me consider: the rule says only emit flag when input metadata clearly wrong and verifiable. The tag "Authentication Bypass" doesn't match a DoS/availability issue in IS-IS graceful restart. But the CWE is 863 = Incorrect Authorization, which aligns with the tag... though CWE-863 for IS-IS graceful restart is questionable. Hmm. Given the CWE given is 863, the tag isn't clearly wrong relative to provided metadata. I'll be cautious: maybe emit a medium-confidence flag. Actually the guidance says empty array is common and correct. But there's genuine mismatch: description is a malformed packet causing premature termination of graceful restart = availability. No authentication bypass occurs. I'll emit one flag with medium confidence. Hmm, risk of being penalized. I think it's reasonable and defensible... Let me lean toward emitting it since the description clearly describes DoS via malformed packet with no authorization bypass. Actually, tagging "Authentication Bypass" would cause wrong categorization. I'll emit with medium confiden
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.
Netcore NR268 routers running firmware 1.7.121109 accept forged firmware images because the mtd_write flashing path does not properly validate the firmware authenticity check performed by check_image_uuid.c, allowing an attacker who can reach the upload endpoint (put_file.cgi) with low privileges to load unauthorized firmware. Successful exploitation gives an attacker full control over the device — high confidentiality, integrity and availability impact per the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) — and the malicious image persists across reboots. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public technical write-up of the forgery technique and a VulnCheck advisory are available.
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
Google Chrome versions earlier than 153.0.8010.47 contain an incorrect authorization flaw (CWE-863) in the WebUI subsystem that lets an attacker who already controls a compromised renderer process break out of the browser sandbox and run arbitrary code on the host via a crafted HTML page. Exploitation is a two-stage proposition: the attacker must first obtain renderer code execution, then chain this flaw to escape the sandbox, and the victim must load the malicious page. Google rates the Chromium security severity as High and has shipped a fix in Chrome 153.0.8010.47; no public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.
Unauthenticated HTTP(S) requests to Digital Watchdog VMAX-series video recorders (VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder, VMAX A1 PLUS, VA1G4 Recorder) can bypass authentication and return sensitive device data, including administrator credentials in plaintext. The flaw is a missing authentication check on a critical function (CWE-306) scored 7.1 with a CVSS 4.0 vector of AV:A/AC:L/PR:N/UI:N/VC:H, meaning adjacent-network attackers with no credentials and no user interaction can fully read the exposed information but cannot modify or disrupt the device. It was reported through CISA ICS-CERT advisory ICSA-26-258-01 and is not listed in CISA KEV, and no public exploit code was identified at time of analysis.
Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.
Unauthenticated attackers positioned on an adjacent network segment can gain root-level control of Digital Watchdog VMAX A1 PLUS, VMAX A1 G4, VA1G4 and VG4 recorders and VMAX IP G4 NVRs, because a critical function performs no authentication and forwards received bytes straight into a system command. CWE-306 combined with that unsafe command handling gives full loss of confidentiality, integrity and availability on the device and on any footage, stored credentials or downstream network reachable through it. Neither public exploit code nor a CISA KEV entry appears in the supplied intelligence, so active exploitation is not confirmed, but the CVSS 4.0 base score of 8.7 reflects the near-trivial effort once adjacency is achieved.
Hard-coded FTP credentials shipped in Digital Watchdog's VMAX and VG4-series recording devices give an attacker who can reach the device's FTP service unauthenticated root-level file access, allowing both reading and overwriting of files on the appliance. The affected lineup spans VMAX A1 PLUS, VG4 Recorder, VA1G4 Recorder, VMAX IP G4 NVR, and VMAX A1 G4 DVR, with EUVD listing all firmware versions as vulnerable, so there is no version-specific safe configuration. The assessed attack vector is adjacent-network (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning the device must be reachable from a neighboring or logically local network segment with FTP enabled; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV). Because the credentials are baked into firmware rather than user-configurable, exposure is a function of network reachability to the FTP service rather than of operator hygiene.
Missing authorization and absent session validation on state-changing CGI endpoints in Digital Watchdog VMAX A1 PLUS, VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder and VA1G4 Recorder devices let an unauthenticated attacker on the adjacent network invoke privileged device operations - including configuration, account and recording-management functions - simply by sending requests to a reachable endpoint, with no credentials or user interaction required. The independent assessment scores this CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact across a scope change, because the compromised CGI layer can affect the broader device and its downstream consumers. The main limiter is the adjacent-network attack vector rather than internet-remote reachability, but that protection disappears whenever a recorder is port-forwarded or sits on a flat network; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.
Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.
Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.
Oracle Agile Engineering Data Management 6.2.1, specifically its Engineering Communication Interface component, can be abused by a low-privileged user who already holds a logon to the host where the application executes, allowing unauthorized reading, creation, deletion or modification of critical engineering data and potentially affecting connected downstream products (CVSS 3.1 scope change, base score 8.4). The flaw is rated High with a local attack vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so it is not remotely exploitable without first obtaining a local session or low-privileged account. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation pressure is currently unquantified.
Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Authorization bypass in Zalando Skipper before 0.27.37 lets unauthenticated remote attackers slip an oversized request body past an Open Policy Agent body-inspection policy: when the opaAuthorizeRequestWithBody filter truncates the body at maxBodyBytes, Skipper derives the input.truncated_body signal from Content-Length rather than the bytes actually read, so an HTTP/1.1 chunked or Content-Length-less HTTP/2 request is evaluated by OPA as non-truncated, allowed, and then forwarded in full to the protected upstream (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, CWE-863). Exploitation is gated on a non-default deployment: the filter must be active and the policy must explicitly allow requests when input.truncated_body == false, the pattern recommended as the prior mitigation for CVE-2026-50197, while installations that do not inspect bodies or do not key on truncated_body are unaffected and requests carrying an accurate Content-Length are correctly flagged as truncated and denied. No public exploit identified at time of analysis.
Unauthenticated remote attackers can read trace and funnel analytics from SigNoz deployments running versions 0.88.0 through 0.141.0 because the trace-funnel analytics HTTP handlers were registered without any authorization wrapper. A single unauthenticated POST to endpoints under the trace-funnels router (both the /{funnel_id}/analytics/* and /analytics/* payload variants) returns identifiers, durations, span counts, service topology, and error activity, and because the payload-style handlers accept attacker-supplied funnel definitions, no pre-existing funnel or account is required. Exploitation is bounded by network reachability to the query-service listener and is read-only (no modification or code execution), and no public exploit code has been identified at time of analysis.
SIMAC MyPHR 1.1 exposes an insecure direct object reference (IDOR) in its employee-update API that lets any authenticated user with a valid low-privileged account access and modify arbitrary employee records. By sending a PUT request with another employee's identifier and a controlled password value, an attacker can take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information such as private pay bulletins. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 base score of 8.7; active exploitation has not been confirmed by CISA KEV status in the provided data.
Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No public exploit code was identified at time of analysis.
Local attackers with write access to Nuclei's on-disk template storage can bypass template signature verification and cause arbitrary operating system commands to execute from a tampered template in ProjectDiscovery Nuclei versions before 3.11.1 (reported as 3.7.0 through 3.10.x). The root cause is CWE-347: cached signature-verification results were keyed only on a template file's modification time, so an attacker can swap a previously verified template for unsigned malicious content and restore the original mtime to have the stale 'verified' result reused under the default configuration where unsigned templates are disabled. The assessed attack path requires local low-privilege access (CVSS 4.0 PR:L) plus a victim operator actually running a scan against the tampered template (UI:P), so this is an access-gated supply-chain integrity flaw rather than a remotely exploitable or wormable one; no public exploit identified at time of analysis, and the vendor-released fix in 3.11.1 binds cache reuse to a content digest.
Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.
Signature forgery in Sequoia OpenPGP (sequoia-openpgp) stems from incorrect key-flag inference for legacy OpenPGP certificates that lack a key-flags subpacket, letting an unauthenticated remote attacker bypass the back-signature check and bind an arbitrary subkey to their own certificate. This compromises cryptographic integrity for any application that uses the library to verify untrusted certificates, although exploitation requires the victim to process a crafted certificate (UI:R). No public exploit code or CISA KEV entry was identified in the provided data.
Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. Impact is integrity-only (CVSS 3.1 assessed: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; vendor-published CVSS 4.0 score 7.1, VI:H), requiring only a valid low-privileged account with no admin role and no user interaction; no public exploit code was identified at time of analysis.
Improper access control in stylefeng Guns through 8.3.5 lets any authenticated user, even one with no assigned roles, create, edit, delete, publish, and retract system-wide notices via SysNoticeController actions that never require a permission. The issue is remotely exploitable with low privileges and high integrity impact but no confidentiality or availability impact; no public exploit code has been identified at time of analysis, and authentication is required (PR:L) because the attacker must already have a valid Guns session.
Missing authorization in the Guns Java rapid-development framework (through 8.3.5) allows any authenticated user to harvest the full user directory, including account names, real names, email addresses, phone numbers, last-login IPs and role assignments. The /sysUser/detail and /sysUser/page handlers in SysUserController omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them and returns data for every user in the system to anyone holding a valid login token. The attack is network-reachable and needs only a low-privileged authenticated session (PR:L), with no user interaction and no administrative rights; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied in the source data.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR methods by sending a POST to a URL their role is allowed to reach while naming a privileged class and method in the request body, bypassing Spring Security's URL-pattern-only access control; the assessed severity is CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact once the flaw is chained with the other Tenable-reported findings it enables. Exploitation is not anonymous: the attacker must already hold a valid low-privilege ScadaLTS session, and the deployment must run with DWR's crossDomainSessionSecurity setting set to false in web.xml (the default in the affected build), which disables DWR's built-in origin and session validation. No confirmed active exploitation (CISA KEV) and no public exploit code were identified in the available intelligence at time of analysis, so the practical urgency is driven by the credential precondition rather than by observed attacks.
reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. No public exploit identified at time of analysis, and successful exploitation requires an authenticated account plus configured integrations to expose meaningful secrets.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.
Authorization bypass in @fastify/auth versions 5.0.0 through 5.1.0 lets an authenticated low-privileged attacker who possesses a credential satisfying only the final member of a nested AND group, such as a valid API key without administrator rights, be authorized instead of rejected. The flaw occurs when strategies are composed with the relation "or" option together with the run "all" option and an entry is a nested array acting as an AND group, causing the group result to collapse to its last check; a mirror order-dependent bypass exists for top-level relation "and" with a nested "or" group. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the vendor-released fix is version 5.1.1 or later.
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.
Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.
Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.
Missing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one with zero assigned roles - invoke administrative APIs for user management, role assignment, password resets by user ID, and Elasticsearch index deletion, because the shipped default of zlt.security.auth.urlPermission.enable is false and suppresses all permission checks once authentication succeeds. Exploitation is not pre-auth: it requires a valid low-privilege session against a deployment running the out-of-the-box configuration, and publicly available exploit code exists (VulnCheck-reported PoC scripts covering role-granting, user enumeration, password reset, and ES index deletion), though no confirmed active exploitation (CISA KEV) has been recorded. Assessed severity is high (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8; vendor-published CVSS 4.0 score 8.7) because a zero-role user obtains both read and write access to sensitive administrative functions.
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. Impact is total: full read/write/execute control of the administrative panel, which is why the score is high (CVSS 4.0 8.7; assessed CVSS 3.1 8.7, C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor firmware 1.1.0.651412 resolves the issue.
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege operators - to read the installation-wide audit trail by calling GET /admin-api/crm/operatelog/page, exposing operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. Publicly available exploit code exists (a PoC script that queries the endpoint), and although exploitation requires a valid back-office session with network reach to the admin API, no elevated role or user interaction is needed, so the realistic threat is a malicious insider or anyone who has reused or stolen an operator credential. The vulnerability is broken access control (CWE-862) with high confidentiality impact only; it does not permit data modification, service disruption, or pre-authentication compromise.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales leads belonging to other employees by invoking the CrmCluesController receiveCustomer lead-claim endpoint with a manipulated ownerUserId value. The flaw is a broken access control (CWE-862) issue that requires only a valid low-privilege staff login and no administrative role, feature toggle, or user interaction, with the practical impact limited to integrity of lead ownership data (no confidentiality or availability impact). Publicly available exploit code exists in the form of a Python proof-of-concept targeting the endpoint, and the absence of access logging or quota validation on the operation removes any built-in brake on bulk lead theft, though no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privilege level, invoke the saveRedisSet and getRedisSet endpoints in CrmCustomerController and rewrite the installation-wide Redis keys that drive lead allocation and customer auto-recycling. Because the scheduled CustomerAutoJob consumes those same keys, a low-privilege staff account can disable recycling, block customer creation, or trigger mass customer deletion across the deployment; publicly available exploit code exists (the VulnCheck-referenced CVE request PoC on GitHub), while no active exploitation has been confirmed and the CVE is not listed in CISA KEV. This is a genuine but bounded-priority issue: exploitation requires a valid CRM account (assessed CVSS PR:L, so unauthenticated remote abuse is not possible), and the assessed impact is high integrity loss to shared policy state (I:H) with a limited availability effect (A:L) and no confidentiality loss (C:N - the readable values are configuration/policy keys, not customer records).
Wild-pointer dereference in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets an unexpected STATUS_TYPE completion IOCB reach a SCSI-only fast path, where the srb union is reinterpreted so sp->u.scmd.cmd reads as a non-NULL garbage pointer and is dereferenced. Only hosts running the qla2xxx driver with a physical QLogic FC HBA are exposed, and only when the adapter firmware or FC fabric delivers a mis-typed status IOCB that coincides with a live non-SCSI outstanding handle; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, so the realistic outcome is a kernel crash rather than reliable code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor patches are available for all maintained stable branches.
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Unauthenticated remote access to the configuration download function on XikeStor Layer3 switches (SKS8300-8T, SKS8300-12E2T2X, SKS8310-8X) running firmware below V1.04.B09 exposes full device configuration files to any network-reachable attacker. Recovered configurations contain network topology details and credentials, enabling attackers to authenticate to the switch itself or leverage it as a pivot point into the protected network segment it manages. Disclosed by JPCERT/CC (JVN#45281119); no public exploit code or active exploitation (CISA KEV) identified at time of analysis.
Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.
Let me synthesize. Product: Arista EOS. Key data: CVSS 4.0 vector: AV:A (adjacent), AC:H, AT:P (attack requirements present), PR:N, UI:N, VC:N, VI:N, VA:H, SC:N, SI:N, SA:H. CVSS score 7.0. CWE-863 (Incorrect Authorization) — hmm, that's a bit odd for a malformed packet handling issue; likely a mismatch worth flagging in confidence notes. Tags: "Authentication Bypass" — that seems mislabeled; the description is about malformed IS-IS LSP PDU causing graceful restart procedure termination — an availability issue, not auth bypass. Also CWE-863 mismatch. I could emit a data_quality_flag mislabeled_tag "Authentication Bypass". Hmm — is that highly confident? The description says unauthenticated attacker, but it's not authentication bypass — it's a protocol-level denial of service. CWE-863 incorrect authorization. The tag "Authentication Bypass" is arguably wrong. I think it's defensible to flag as mislabeled_tag with medium/high confidence. Let me consider: the rule says only emit flag when input metadata clearly wrong and verifiable. The tag "Authentication Bypass" doesn't match a DoS/availability issue in IS-IS graceful restart. But the CWE is 863 = Incorrect Authorization, which aligns with the tag... though CWE-863 for IS-IS graceful restart is questionable. Hmm. Given the CWE given is 863, the tag isn't clearly wrong relative to provided metadata. I'll be cautious: maybe emit a medium-confidence flag. Actually the guidance says empty array is common and correct. But there's genuine mismatch: description is a malformed packet causing premature termination of graceful restart = availability. No authentication bypass occurs. I'll emit one flag with medium confidence. Hmm, risk of being penalized. I think it's reasonable and defensible... Let me lean toward emitting it since the description clearly describes DoS via malformed packet with no authorization bypass. Actually, tagging "Authentication Bypass" would cause wrong categorization. I'll emit with medium confiden
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.
Netcore NR268 routers running firmware 1.7.121109 accept forged firmware images because the mtd_write flashing path does not properly validate the firmware authenticity check performed by check_image_uuid.c, allowing an attacker who can reach the upload endpoint (put_file.cgi) with low privileges to load unauthorized firmware. Successful exploitation gives an attacker full control over the device — high confidentiality, integrity and availability impact per the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) — and the malicious image persists across reboots. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public technical write-up of the forgery technique and a VulnCheck advisory are available.
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
Google Chrome versions earlier than 153.0.8010.47 contain an incorrect authorization flaw (CWE-863) in the WebUI subsystem that lets an attacker who already controls a compromised renderer process break out of the browser sandbox and run arbitrary code on the host via a crafted HTML page. Exploitation is a two-stage proposition: the attacker must first obtain renderer code execution, then chain this flaw to escape the sandbox, and the victim must load the malicious page. Google rates the Chromium security severity as High and has shipped a fix in Chrome 153.0.8010.47; no public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.
Unauthenticated HTTP(S) requests to Digital Watchdog VMAX-series video recorders (VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder, VMAX A1 PLUS, VA1G4 Recorder) can bypass authentication and return sensitive device data, including administrator credentials in plaintext. The flaw is a missing authentication check on a critical function (CWE-306) scored 7.1 with a CVSS 4.0 vector of AV:A/AC:L/PR:N/UI:N/VC:H, meaning adjacent-network attackers with no credentials and no user interaction can fully read the exposed information but cannot modify or disrupt the device. It was reported through CISA ICS-CERT advisory ICSA-26-258-01 and is not listed in CISA KEV, and no public exploit code was identified at time of analysis.
Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.
Unauthenticated attackers positioned on an adjacent network segment can gain root-level control of Digital Watchdog VMAX A1 PLUS, VMAX A1 G4, VA1G4 and VG4 recorders and VMAX IP G4 NVRs, because a critical function performs no authentication and forwards received bytes straight into a system command. CWE-306 combined with that unsafe command handling gives full loss of confidentiality, integrity and availability on the device and on any footage, stored credentials or downstream network reachable through it. Neither public exploit code nor a CISA KEV entry appears in the supplied intelligence, so active exploitation is not confirmed, but the CVSS 4.0 base score of 8.7 reflects the near-trivial effort once adjacency is achieved.
Hard-coded FTP credentials shipped in Digital Watchdog's VMAX and VG4-series recording devices give an attacker who can reach the device's FTP service unauthenticated root-level file access, allowing both reading and overwriting of files on the appliance. The affected lineup spans VMAX A1 PLUS, VG4 Recorder, VA1G4 Recorder, VMAX IP G4 NVR, and VMAX A1 G4 DVR, with EUVD listing all firmware versions as vulnerable, so there is no version-specific safe configuration. The assessed attack vector is adjacent-network (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning the device must be reachable from a neighboring or logically local network segment with FTP enabled; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV). Because the credentials are baked into firmware rather than user-configurable, exposure is a function of network reachability to the FTP service rather than of operator hygiene.
Missing authorization and absent session validation on state-changing CGI endpoints in Digital Watchdog VMAX A1 PLUS, VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder and VA1G4 Recorder devices let an unauthenticated attacker on the adjacent network invoke privileged device operations - including configuration, account and recording-management functions - simply by sending requests to a reachable endpoint, with no credentials or user interaction required. The independent assessment scores this CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact across a scope change, because the compromised CGI layer can affect the broader device and its downstream consumers. The main limiter is the adjacent-network attack vector rather than internet-remote reachability, but that protection disappears whenever a recorder is port-forwarded or sits on a flat network; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.
Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.
Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.
Oracle Agile Engineering Data Management 6.2.1, specifically its Engineering Communication Interface component, can be abused by a low-privileged user who already holds a logon to the host where the application executes, allowing unauthorized reading, creation, deletion or modification of critical engineering data and potentially affecting connected downstream products (CVSS 3.1 scope change, base score 8.4). The flaw is rated High with a local attack vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so it is not remotely exploitable without first obtaining a local session or low-privileged account. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation pressure is currently unquantified.
Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.