Authentication Bypass
Monthly
Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
Unauthenticated remote attackers can arbitrarily modify wireless transmit-power settings or deny wireless service on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 by sending a crafted POST to the device's CGI management interface. The setWiFiSignalCfg function is reachable without any authentication gate, a CWE-284 improper access control defect that allows an adversary to degrade or eliminate wireless connectivity for all clients on the affected device. No public exploit code or CISA KEV listing is recorded; EPSS at 0.18% (7th percentile) reflects minimal current exploitation interest despite trivially automatable attack conditions.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Unauthenticated device deletion in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers remove any managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delDevice function fails to enforce access control (CWE-284), so no credentials are needed. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), indicating limited observed interest despite the high CVSS 9.1 rating.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.
Unauthenticated manipulation of the firmware upload/flash workflow in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible by sending crafted POST requests to the setUploadSetting handler in /cgi-bin/cstecgi.cgi, which lacks any authentication or access-control check (CWE-284). Any attacker with network reachability to the web interface can alter upload/flash settings, potentially corrupting or hijacking a firmware update and rendering the device inoperable. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating no observed mass exploitation despite the 9.8 CVSS rating.
Vertical privilege escalation in XueZhiSi XZS Open Source Exam System (versions <= 3.9.0) allows an authenticated teacher account (role=2) to permanently delete administrator accounts (role=3) via the POST /api/teacher/user/delete/{id} REST endpoint. The three-step delete sequence - getUserById(id), setDeleted(true), updateByIdFilter() - executes without any role-based authorization check on the target resource, enabling a lower-privileged user to destroy privileged accounts irreversibly. No public exploit code or CISA KEV listing exists; EPSS sits at 0.15%, reflecting minimal observed activity at time of analysis.
Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Root-level device takeover in the Tenda HG21 gateway (firmware V4.0.0-260302) stems from hardcoded credentials baked into the built-in Admin account, letting attackers authenticate and obtain full root access. The flaw is remotely reachable and requires no legitimate credentials since the login secret is static across devices, and a public GitHub gist writeup/exploit is available. It is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Unauthenticated remote manipulation of static DHCP rules on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 is possible due to missing access controls in the setStaticDhcpRules handler at /cgi-bin/cstecgi.cgi. An attacker with network access to the router's management interface can send a crafted POST request to add or replace DHCP reservations without any authentication. No public exploit has been confirmed in CISA KEV, though researcher-coordinated disclosure references exist on GitHub, and exploitation is straightforward given zero prerequisites.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Improper access control in the setUpgradeFW function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the firmware-upgrade workflow by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the CGI endpoint enforces no authentication, an attacker on a reachable network can tamper with the device's firmware update process, risking integrity compromise and denial of service (bricking). EPSS is low (0.18%, 7th percentile) and there is no public exploit or KEV listing at time of analysis.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware download state data via the getCloudDownloadStatus CGI function. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms fully remote, zero-interaction exploitation with no credentials required against the device's web management interface. No public exploit identified at time of analysis, though coordinated disclosure activity is documented in researcher GitHub repositories; the vulnerability is not listed in the CISA KEV catalog.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers read the device's roaming enablement flag by sending a crafted POST request to the getRoamingCfg handler at /cgi-bin/cstecgi.cgi. The flaw is an access-control failure (CWE-284) on a CGI endpoint that should require authentication, and it is reachable over the network with no user interaction. No public exploit code has been identified and it is not listed in CISA KEV, though the trivial request-based trigger makes reproduction straightforward.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
Missing authorization in the setWiFiGuestCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers create or weaken the guest wireless network by POSTing a crafted request to /cgi-bin/cstecgi.cgi. Because the setter applies configuration without any session or credential check, an attacker can stand up an open/weakly-secured guest SSID or downgrade guest isolation without ever authenticating. No public exploit is identified at time of analysis and EPSS is low (0.16%), but exploitation is trivial against the affected build.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reconfigure the device's VPN pass-through / edge-filtering settings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which fails to authenticate calls to the setVpnPassCfg function. Successful exploitation weakens the router's perimeter filtering, degrading the security posture protecting devices behind it. No public exploit code has been identified and the CVE is not on CISA KEV; EPSS is low at 0.16% (6th percentile).
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiEasyGuestCf handler on /cgi-bin/cstecgi.cgi with no credentials, creating or weakening the guest wireless network configuration. An attacker can enable or reconfigure guest WiFi to broaden its reach or lower its security, providing an unauthorized foothold onto the local network. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the missing-authorization pattern is trivial to script.
Clock manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device system time by sending a crafted POST request to the NTPSyncWithHost handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so no credentials are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the assigned CVSS 9.1 appears inflated relative to the described 'change the clock' impact.
Unauthenticated DDNS configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to alter dynamic DNS state without credentials. The setDdnsCfg function in the CGI-based web interface (/cgi-bin/cstecgi.cgi) fails to enforce access control, making exploitation trivial via a crafted POST request. EPSS is low at 0.16% (6th percentile) and no CISA KEV listing exists, though GitHub-hosted vendor-coordination repositories suggest researcher-coordinated disclosure and likely proof-of-concept material is available.
Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers abuse the setScheduleCfg handler on /cgi-bin/cstecgi.cgi to schedule forced reboot tasks without any credentials. Because the endpoint fails to enforce access control (CWE-284), a single crafted POST can register recurring reboots that render the device persistently unavailable, and the same missing check likely exposes other schedule/config parameters. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is trivial and network-reachable.
Unauthenticated custom-CGI-module installation on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers plant attacker-controlled CGI code through the UploadCustomModule handler in /cgi-bin/cstecgi.cgi. Because the endpoint enforces no authentication or access control, a single crafted POST request installs an executable module - effectively arbitrary code execution on the device. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), indicating no observed mass exploitation yet.
Cross-tenant data disclosure in ash_graphql affects authenticated subscribers in multi-tenant deployments running versions 1.4.0 through 1.10.x. The subscription resolver's in-memory authorization fast path evaluates read policy filters without any tenant condition, allowing a subscriber scoped to tenant A to receive GraphQL subscription notifications carrying tenant B's records. The single-notification code path had no tenant guard at all, and the batched path checked tenant only on the list head, leaving all subsequent entries to authorize purely in memory without tenancy enforcement. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the impact is high confidentiality loss for any multi-tenant SaaS product built on this stack.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. Additional endpoints /agent/stop and /agent/storemocks allow unauthenticated manipulation of test recording sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation requires only a standard HTTP client.
Incorrect authorization in Frappe Framework development builds allows any authenticated low-privileged user holding print permission on a document to supply raw Jinja template strings to the render_jinja_template endpoint, bypassing the intended System Manager restriction. The template engine executes these strings server-side, enabling arbitrary SELECT queries across unrelated database tables - critically including extraction of password hashes from the __Auth table. No public exploit has been identified at the time of analysis, but the attack is mechanically straightforward for any user with a valid Frappe account and default print permissions, making credential theft the primary real-world risk.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Privilege escalation in Sudo through 1.9.17p2 allows any local user holding a sudo rule to execute arbitrary commands when ptrace-based intercept mode is enabled. The intercept layer in exec_ptrace.c monitored only execve(2) system calls, leaving execveat(2) - and the fexecve libc wrapper built atop it - entirely uninspected, bypassing both policy enforcement and audit logging. No public exploit has been identified at time of analysis; the upstream fix is available as a confirmed commit to the sudo-project repository.
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0 lets an already-authenticated user complete WebAuthn login as an arbitrary victim account. The webauthn_login route resolves the target account from the session identifier rather than binding the presented WebAuthn credential to its owning account, so a logged-in attacker can pivot into any other account, yielding full account takeover. Reported by VulnCheck; a vendor patch (2.46.0) exists and the fix commit ships a reproduction test, but there is no public exploit identified and no active exploitation on record.
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information and enables unauthorized message injection by unauthenticated remote attackers. The flaw, rooted in CWE-639 (authorization bypass via user-controlled key), allows an attacker to resolve or collide with another user's namespace without requiring authentication, as confirmed by the CVSS vector (PR:N). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack surface warrants prompt remediation.
Remote unauthenticated execution of arbitrary AI workflows in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information via an authentication bypass (CWE-287). The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms zero prerequisites - any network-reachable instance can be targeted without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial attack complexity combined with high confidentiality impact and vendor-confirmed patch availability makes this an immediate remediation priority for any organization running an exposed Langflow instance.
Improper authentication enforcement in IBM Administration Runtime Expert for i 1R1M0 exposes sensitive information to remote attackers over the network. The flaw (CWE-287) allows an attacker to bypass or circumvent authentication controls on protected endpoints, resulting in high-confidentiality-impact disclosure with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node/7284580.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
phpSysInfo up to and including version 3.4.5 exposes a complete IP allowlist bypass in read_config.php that any unauthenticated remote attacker can exploit by sending a spoofed X-Forwarded-For or Client-IP HTTP header set to any address present in the PSI_ALLOWED configuration. The flaw (CWE-290) renders the application's only access-control mechanism entirely ineffective, allowing full retrieval of system telemetry including hostname, kernel version, CPU model, memory layout, filesystems, and network interface addresses. A working proof-of-concept is publicly available on Exploit-DB; no CISA KEV listing exists at time of analysis.
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Missing function-level access control in Yamcs Core's REST API allows any authenticated user - including completely unprivileged 'Guest' accounts - to bypass the platform's RBAC system across three distinct API controllers. Affected endpoints in IndexesApi, Cop1Api, and TimeApi omit authorization checks entirely, enabling telemetry metadata exfiltration, disruption of COP-1 satellite telecommand protocols, and manipulation of global simulation time. Publicly available exploit code (curl-based PoC) confirms exploitability; the vulnerability is not currently listed in CISA KEV, though the spacecraft operations context elevates real-world impact severity.
Cross-tenant IDOR in Vikunja's kanban task-placement endpoint (POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks) allows any authenticated user to read the complete contents of any task on the instance and partially mutate its state, defeating Vikunja's project-isolation model. The authorization check in TaskBucket.CanUpdate validates only the URL-scoped project and bucket, never the attacker-controlled task_id supplied in the JSON body; because task IDs are a global sequential integer space, brute-force enumeration of all instance tasks is trivial. This is the fifth documented instance of the same missing-authorization-on-task-child class in Vikunja (siblings: CVE-2026-33676, CVE-2026-33678, CVE-2026-33313, CVE-2026-35598); the vendor-confirmed fix ships in v2.4.0 and no public exploit beyond the detailed advisory proof-of-concept has been identified at time of analysis.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.
Missing ownership validation across three Quivr chat API endpoints through version 0.0.322 enables any authenticated user to read, delete, or inject fabricated messages into other users' private conversations and associated knowledge base content. The vulnerable endpoints (GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, POST /chat/{chat_id}/question/answer) accept user-supplied chat IDs without server-side authorization checks, a classic IDOR (CWE-639) pattern. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the low-complexity, authenticated-only prerequisite makes exploitation trivially accessible to any malicious account holder in a multi-user deployment.
Insecure Direct Object Reference in VoltAgent through 2.1.20 allows any authenticated user to read, modify, or delete conversations belonging to other users by supplying arbitrary conversation identifiers to memory API endpoints. The server accepts caller-controlled identifiers without verifying ownership, enabling horizontal privilege escalation across all users of a shared deployment. No public exploit has been identified at time of analysis, but the IDOR pattern (CWE-639) is trivially exploitable by any account holder with basic API knowledge.
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Prompt endpoint ownership validation failure in Quivr through 0.0.322 enables authenticated users with only read-only brain access to overwrite any system prompt by supplying a harvested prompt identifier to an unprotected write endpoint. The IDOR flaw (CWE-639) means that low-privileged authenticated accounts can silently corrupt AI brain behavior for all users of a shared brain, with no elevated privileges required beyond a valid session. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad scope of impact across all brain users make this a practical integrity threat in multi-tenant Quivr deployments.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. An authenticated or link-holding attacker can enumerate and retrieve locked media and its metadata without any further privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Redpanda through version 26.2.2 exposes the cluster Admin API on 0.0.0.0:9644 with admin_api_require_auth defaulting to false, so any request reaching that port is silently treated as a superuser. Unauthenticated network attackers can create and delete broker accounts, rewrite cluster configuration, and disrupt partition replication, giving them full administrative control of the streaming platform. Rated CVSS 4.0 9.3 (Critical); no public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers to bypass IP-based access controls on Go-based SSH servers using PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin authentication paths. Versions prior to 0.55.0 silently ignore source-address restrictions returned by these callbacks, defeating an explicit authorization control set by the server application. This is an incomplete fix extending CVE-2026-46595; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.
Missing authorization on license management REST endpoints in Budibase server before 3.41.3 allows any low-privilege authenticated user to delete license keys or manipulate offline tokens via /api/global/license/* - degrading or disabling premium features for the entire deployment. The flaw (CWE-862) is network-exploitable with low complexity and requires only a valid user account, making it accessible to the broadest possible authenticated audience within a deployment. No public exploit or CISA KEV listing exists at time of analysis, but the attack path is trivially reproducible given endpoint documentation.
Cross-application resource injection in Budibase Server before 3.41.3 allows any authenticated builder to plant tables, automations, queries, and screens into workspaces they have no authorized access to. The POST /api/resources/duplicate endpoint accepts an arbitrary destination workspace ID in the request body and performs no authorization check against the destination, enabling horizontal privilege escalation across workspace boundaries. Once malicious automations are injected, an attacker can trigger them to fire outbound webhooks relaying victim application data to attacker-controlled infrastructure, achieving data exfiltration. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.41.3.
Privilege escalation in Budibase server before 3.41.3 allows an authenticated app-scoped builder to gain unauthorized builder access across all applications within the same tenant. By submitting crafted requests to the public user create or update API endpoints with manipulated builder.apps fields, the attacker bypasses the missing authorization check and self-assigns elevated builder privileges over unrelated applications. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the network-accessible, low-complexity nature of the attack makes this a significant risk in any multi-tenant Budibase deployment.
Authorization bypass in Budibase Server before 3.41.3 allows any authenticated user holding the lowest-privilege BASIC role to perform unrestricted read, create, update, and delete operations against any application table via the POST /api/datasources/query endpoint. Per-table role restrictions enforced elsewhere in the application are entirely absent on this API path, rendering the access control model trivially circumventable with a standard API call. No public exploit has been identified at time of analysis, though the low attack complexity - requiring only valid BASIC credentials and a crafted HTTP request - makes this a genuine priority for externally-accessible or multi-tenant deployments.
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.
Authorization bypass in Eclipse Lyo 2.0.0 through 7.0.0 lets remote attackers abuse the 2-legged OAuth flow to promote a self-registered 'provisional' trusted client into a fully trusted one without the required administrator approval. Applications that build their authorization filters on Lyo's AbstractAdapterCredentialsFilter are affected, allowing an attacker to act as a trusted OAuth client and access protected OSLC resources. No public exploit identified at time of analysis, and it is not listed in CISA KEV; fixes shipped in 6.0.1.Final and 7.0.0.Beta3.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Unauthenticated information exposure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the getWiFiApcliScan handler via /cgi-bin/cstecgi.cgi to force a wireless scan and read back AP-client scan results without any credentials. The flaw is an incorrect access-control (CWE-284) gap: the CGI endpoint does not verify authentication before executing the scan. No public exploit is identified and EPSS is low (0.18%), though SSVC rates the action as automatable with total technical impact per CISA's framework.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
Unauthenticated network access to the getCloudSrvCheckStatus function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware check status information to any remote attacker who sends a crafted POST to /cgi-bin/cstecgi.cgi. The CWE-284 improper access control flaw requires no credentials or session token, though the leaked data - firmware update check status - is of modest sensitivity compared to credentials or full configuration disclosure. No public exploit code has been independently confirmed; technical details are publicly available via researcher coordination repositories, and EPSS at 0.18% reflects limited observed exploitation pressure at this time.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.
Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
Unauthenticated remote attackers can arbitrarily modify wireless transmit-power settings or deny wireless service on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 by sending a crafted POST to the device's CGI management interface. The setWiFiSignalCfg function is reachable without any authentication gate, a CWE-284 improper access control defect that allows an adversary to degrade or eliminate wireless connectivity for all clients on the affected device. No public exploit code or CISA KEV listing is recorded; EPSS at 0.18% (7th percentile) reflects minimal current exploitation interest despite trivially automatable attack conditions.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Unauthenticated device deletion in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers remove any managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delDevice function fails to enforce access control (CWE-284), so no credentials are needed. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), indicating limited observed interest despite the high CVSS 9.1 rating.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.
Unauthenticated manipulation of the firmware upload/flash workflow in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible by sending crafted POST requests to the setUploadSetting handler in /cgi-bin/cstecgi.cgi, which lacks any authentication or access-control check (CWE-284). Any attacker with network reachability to the web interface can alter upload/flash settings, potentially corrupting or hijacking a firmware update and rendering the device inoperable. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating no observed mass exploitation despite the 9.8 CVSS rating.
Vertical privilege escalation in XueZhiSi XZS Open Source Exam System (versions <= 3.9.0) allows an authenticated teacher account (role=2) to permanently delete administrator accounts (role=3) via the POST /api/teacher/user/delete/{id} REST endpoint. The three-step delete sequence - getUserById(id), setDeleted(true), updateByIdFilter() - executes without any role-based authorization check on the target resource, enabling a lower-privileged user to destroy privileged accounts irreversibly. No public exploit code or CISA KEV listing exists; EPSS sits at 0.15%, reflecting minimal observed activity at time of analysis.
Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Root-level device takeover in the Tenda HG21 gateway (firmware V4.0.0-260302) stems from hardcoded credentials baked into the built-in Admin account, letting attackers authenticate and obtain full root access. The flaw is remotely reachable and requires no legitimate credentials since the login secret is static across devices, and a public GitHub gist writeup/exploit is available. It is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Unauthenticated remote manipulation of static DHCP rules on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 is possible due to missing access controls in the setStaticDhcpRules handler at /cgi-bin/cstecgi.cgi. An attacker with network access to the router's management interface can send a crafted POST request to add or replace DHCP reservations without any authentication. No public exploit has been confirmed in CISA KEV, though researcher-coordinated disclosure references exist on GitHub, and exploitation is straightforward given zero prerequisites.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Improper access control in the setUpgradeFW function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the firmware-upgrade workflow by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the CGI endpoint enforces no authentication, an attacker on a reachable network can tamper with the device's firmware update process, risking integrity compromise and denial of service (bricking). EPSS is low (0.18%, 7th percentile) and there is no public exploit or KEV listing at time of analysis.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware download state data via the getCloudDownloadStatus CGI function. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms fully remote, zero-interaction exploitation with no credentials required against the device's web management interface. No public exploit identified at time of analysis, though coordinated disclosure activity is documented in researcher GitHub repositories; the vulnerability is not listed in the CISA KEV catalog.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers read the device's roaming enablement flag by sending a crafted POST request to the getRoamingCfg handler at /cgi-bin/cstecgi.cgi. The flaw is an access-control failure (CWE-284) on a CGI endpoint that should require authentication, and it is reachable over the network with no user interaction. No public exploit code has been identified and it is not listed in CISA KEV, though the trivial request-based trigger makes reproduction straightforward.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
Missing authorization in the setWiFiGuestCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers create or weaken the guest wireless network by POSTing a crafted request to /cgi-bin/cstecgi.cgi. Because the setter applies configuration without any session or credential check, an attacker can stand up an open/weakly-secured guest SSID or downgrade guest isolation without ever authenticating. No public exploit is identified at time of analysis and EPSS is low (0.16%), but exploitation is trivial against the affected build.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reconfigure the device's VPN pass-through / edge-filtering settings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which fails to authenticate calls to the setVpnPassCfg function. Successful exploitation weakens the router's perimeter filtering, degrading the security posture protecting devices behind it. No public exploit code has been identified and the CVE is not on CISA KEV; EPSS is low at 0.16% (6th percentile).
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiEasyGuestCf handler on /cgi-bin/cstecgi.cgi with no credentials, creating or weakening the guest wireless network configuration. An attacker can enable or reconfigure guest WiFi to broaden its reach or lower its security, providing an unauthorized foothold onto the local network. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the missing-authorization pattern is trivial to script.
Clock manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device system time by sending a crafted POST request to the NTPSyncWithHost handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so no credentials are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the assigned CVSS 9.1 appears inflated relative to the described 'change the clock' impact.
Unauthenticated DDNS configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to alter dynamic DNS state without credentials. The setDdnsCfg function in the CGI-based web interface (/cgi-bin/cstecgi.cgi) fails to enforce access control, making exploitation trivial via a crafted POST request. EPSS is low at 0.16% (6th percentile) and no CISA KEV listing exists, though GitHub-hosted vendor-coordination repositories suggest researcher-coordinated disclosure and likely proof-of-concept material is available.
Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers abuse the setScheduleCfg handler on /cgi-bin/cstecgi.cgi to schedule forced reboot tasks without any credentials. Because the endpoint fails to enforce access control (CWE-284), a single crafted POST can register recurring reboots that render the device persistently unavailable, and the same missing check likely exposes other schedule/config parameters. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is trivial and network-reachable.
Unauthenticated custom-CGI-module installation on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers plant attacker-controlled CGI code through the UploadCustomModule handler in /cgi-bin/cstecgi.cgi. Because the endpoint enforces no authentication or access control, a single crafted POST request installs an executable module - effectively arbitrary code execution on the device. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), indicating no observed mass exploitation yet.
Cross-tenant data disclosure in ash_graphql affects authenticated subscribers in multi-tenant deployments running versions 1.4.0 through 1.10.x. The subscription resolver's in-memory authorization fast path evaluates read policy filters without any tenant condition, allowing a subscriber scoped to tenant A to receive GraphQL subscription notifications carrying tenant B's records. The single-notification code path had no tenant guard at all, and the batched path checked tenant only on the list head, leaving all subsequent entries to authorize purely in memory without tenancy enforcement. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the impact is high confidentiality loss for any multi-tenant SaaS product built on this stack.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. Additional endpoints /agent/stop and /agent/storemocks allow unauthenticated manipulation of test recording sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation requires only a standard HTTP client.
Incorrect authorization in Frappe Framework development builds allows any authenticated low-privileged user holding print permission on a document to supply raw Jinja template strings to the render_jinja_template endpoint, bypassing the intended System Manager restriction. The template engine executes these strings server-side, enabling arbitrary SELECT queries across unrelated database tables - critically including extraction of password hashes from the __Auth table. No public exploit has been identified at the time of analysis, but the attack is mechanically straightforward for any user with a valid Frappe account and default print permissions, making credential theft the primary real-world risk.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Privilege escalation in Sudo through 1.9.17p2 allows any local user holding a sudo rule to execute arbitrary commands when ptrace-based intercept mode is enabled. The intercept layer in exec_ptrace.c monitored only execve(2) system calls, leaving execveat(2) - and the fexecve libc wrapper built atop it - entirely uninspected, bypassing both policy enforcement and audit logging. No public exploit has been identified at time of analysis; the upstream fix is available as a confirmed commit to the sudo-project repository.
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0 lets an already-authenticated user complete WebAuthn login as an arbitrary victim account. The webauthn_login route resolves the target account from the session identifier rather than binding the presented WebAuthn credential to its owning account, so a logged-in attacker can pivot into any other account, yielding full account takeover. Reported by VulnCheck; a vendor patch (2.46.0) exists and the fix commit ships a reproduction test, but there is no public exploit identified and no active exploitation on record.
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information and enables unauthorized message injection by unauthenticated remote attackers. The flaw, rooted in CWE-639 (authorization bypass via user-controlled key), allows an attacker to resolve or collide with another user's namespace without requiring authentication, as confirmed by the CVSS vector (PR:N). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack surface warrants prompt remediation.
Remote unauthenticated execution of arbitrary AI workflows in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information via an authentication bypass (CWE-287). The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms zero prerequisites - any network-reachable instance can be targeted without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial attack complexity combined with high confidentiality impact and vendor-confirmed patch availability makes this an immediate remediation priority for any organization running an exposed Langflow instance.
Improper authentication enforcement in IBM Administration Runtime Expert for i 1R1M0 exposes sensitive information to remote attackers over the network. The flaw (CWE-287) allows an attacker to bypass or circumvent authentication controls on protected endpoints, resulting in high-confidentiality-impact disclosure with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node/7284580.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
phpSysInfo up to and including version 3.4.5 exposes a complete IP allowlist bypass in read_config.php that any unauthenticated remote attacker can exploit by sending a spoofed X-Forwarded-For or Client-IP HTTP header set to any address present in the PSI_ALLOWED configuration. The flaw (CWE-290) renders the application's only access-control mechanism entirely ineffective, allowing full retrieval of system telemetry including hostname, kernel version, CPU model, memory layout, filesystems, and network interface addresses. A working proof-of-concept is publicly available on Exploit-DB; no CISA KEV listing exists at time of analysis.
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Missing function-level access control in Yamcs Core's REST API allows any authenticated user - including completely unprivileged 'Guest' accounts - to bypass the platform's RBAC system across three distinct API controllers. Affected endpoints in IndexesApi, Cop1Api, and TimeApi omit authorization checks entirely, enabling telemetry metadata exfiltration, disruption of COP-1 satellite telecommand protocols, and manipulation of global simulation time. Publicly available exploit code (curl-based PoC) confirms exploitability; the vulnerability is not currently listed in CISA KEV, though the spacecraft operations context elevates real-world impact severity.
Cross-tenant IDOR in Vikunja's kanban task-placement endpoint (POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks) allows any authenticated user to read the complete contents of any task on the instance and partially mutate its state, defeating Vikunja's project-isolation model. The authorization check in TaskBucket.CanUpdate validates only the URL-scoped project and bucket, never the attacker-controlled task_id supplied in the JSON body; because task IDs are a global sequential integer space, brute-force enumeration of all instance tasks is trivial. This is the fifth documented instance of the same missing-authorization-on-task-child class in Vikunja (siblings: CVE-2026-33676, CVE-2026-33678, CVE-2026-33313, CVE-2026-35598); the vendor-confirmed fix ships in v2.4.0 and no public exploit beyond the detailed advisory proof-of-concept has been identified at time of analysis.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.
Missing ownership validation across three Quivr chat API endpoints through version 0.0.322 enables any authenticated user to read, delete, or inject fabricated messages into other users' private conversations and associated knowledge base content. The vulnerable endpoints (GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, POST /chat/{chat_id}/question/answer) accept user-supplied chat IDs without server-side authorization checks, a classic IDOR (CWE-639) pattern. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the low-complexity, authenticated-only prerequisite makes exploitation trivially accessible to any malicious account holder in a multi-user deployment.
Insecure Direct Object Reference in VoltAgent through 2.1.20 allows any authenticated user to read, modify, or delete conversations belonging to other users by supplying arbitrary conversation identifiers to memory API endpoints. The server accepts caller-controlled identifiers without verifying ownership, enabling horizontal privilege escalation across all users of a shared deployment. No public exploit has been identified at time of analysis, but the IDOR pattern (CWE-639) is trivially exploitable by any account holder with basic API knowledge.
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Prompt endpoint ownership validation failure in Quivr through 0.0.322 enables authenticated users with only read-only brain access to overwrite any system prompt by supplying a harvested prompt identifier to an unprotected write endpoint. The IDOR flaw (CWE-639) means that low-privileged authenticated accounts can silently corrupt AI brain behavior for all users of a shared brain, with no elevated privileges required beyond a valid session. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad scope of impact across all brain users make this a practical integrity threat in multi-tenant Quivr deployments.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. An authenticated or link-holding attacker can enumerate and retrieve locked media and its metadata without any further privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Redpanda through version 26.2.2 exposes the cluster Admin API on 0.0.0.0:9644 with admin_api_require_auth defaulting to false, so any request reaching that port is silently treated as a superuser. Unauthenticated network attackers can create and delete broker accounts, rewrite cluster configuration, and disrupt partition replication, giving them full administrative control of the streaming platform. Rated CVSS 4.0 9.3 (Critical); no public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers to bypass IP-based access controls on Go-based SSH servers using PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin authentication paths. Versions prior to 0.55.0 silently ignore source-address restrictions returned by these callbacks, defeating an explicit authorization control set by the server application. This is an incomplete fix extending CVE-2026-46595; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.
Missing authorization on license management REST endpoints in Budibase server before 3.41.3 allows any low-privilege authenticated user to delete license keys or manipulate offline tokens via /api/global/license/* - degrading or disabling premium features for the entire deployment. The flaw (CWE-862) is network-exploitable with low complexity and requires only a valid user account, making it accessible to the broadest possible authenticated audience within a deployment. No public exploit or CISA KEV listing exists at time of analysis, but the attack path is trivially reproducible given endpoint documentation.
Cross-application resource injection in Budibase Server before 3.41.3 allows any authenticated builder to plant tables, automations, queries, and screens into workspaces they have no authorized access to. The POST /api/resources/duplicate endpoint accepts an arbitrary destination workspace ID in the request body and performs no authorization check against the destination, enabling horizontal privilege escalation across workspace boundaries. Once malicious automations are injected, an attacker can trigger them to fire outbound webhooks relaying victim application data to attacker-controlled infrastructure, achieving data exfiltration. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.41.3.
Privilege escalation in Budibase server before 3.41.3 allows an authenticated app-scoped builder to gain unauthorized builder access across all applications within the same tenant. By submitting crafted requests to the public user create or update API endpoints with manipulated builder.apps fields, the attacker bypasses the missing authorization check and self-assigns elevated builder privileges over unrelated applications. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the network-accessible, low-complexity nature of the attack makes this a significant risk in any multi-tenant Budibase deployment.
Authorization bypass in Budibase Server before 3.41.3 allows any authenticated user holding the lowest-privilege BASIC role to perform unrestricted read, create, update, and delete operations against any application table via the POST /api/datasources/query endpoint. Per-table role restrictions enforced elsewhere in the application are entirely absent on this API path, rendering the access control model trivially circumventable with a standard API call. No public exploit has been identified at time of analysis, though the low attack complexity - requiring only valid BASIC credentials and a crafted HTTP request - makes this a genuine priority for externally-accessible or multi-tenant deployments.
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.
Authorization bypass in Eclipse Lyo 2.0.0 through 7.0.0 lets remote attackers abuse the 2-legged OAuth flow to promote a self-registered 'provisional' trusted client into a fully trusted one without the required administrator approval. Applications that build their authorization filters on Lyo's AbstractAdapterCredentialsFilter are affected, allowing an attacker to act as a trusted OAuth client and access protected OSLC resources. No public exploit identified at time of analysis, and it is not listed in CISA KEV; fixes shipped in 6.0.1.Final and 7.0.0.Beta3.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Unauthenticated information exposure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the getWiFiApcliScan handler via /cgi-bin/cstecgi.cgi to force a wireless scan and read back AP-client scan results without any credentials. The flaw is an incorrect access-control (CWE-284) gap: the CGI endpoint does not verify authentication before executing the scan. No public exploit is identified and EPSS is low (0.18%), though SSVC rates the action as automatable with total technical impact per CISA's framework.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
Unauthenticated network access to the getCloudSrvCheckStatus function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware check status information to any remote attacker who sends a crafted POST to /cgi-bin/cstecgi.cgi. The CWE-284 improper access control flaw requires no credentials or session token, though the leaked data - firmware update check status - is of modest sensitivity compared to credentials or full configuration disclosure. No public exploit code has been independently confirmed; technical details are publicly available via researcher coordination repositories, and EPSS at 0.18% reflects limited observed exploitation pressure at this time.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.