Authentication Bypass
Monthly
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Unauthenticated remote access to setup wizard and onboarding configuration is possible on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 through missing access control on the getWizardCfg CGI handler. Any attacker reachable to the device's web management interface can send a crafted POST to /cgi-bin/cstecgi.cgi and receive wizard configuration data - which may include ISP connection parameters or other sensitive values collected during initial device setup - without supplying credentials. No active exploitation has been identified (EPSS 0.18%, 7th percentile; not in CISA KEV), and disclosure follows a researcher-coordinated process documented on GitHub.
Unauthenticated LAN and DHCP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve internal network topology data by sending a crafted POST request to /cgi-bin/cstecgi.cgi without any credentials. The getLanCfg CGI handler applies no access control before returning LAN addressing and DHCP server configuration. EPSS at 0.18% (7th percentile) and SSVC 'Exploitation: none' confirm no observed active exploitation; no CISA KEV listing or public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN interface, LAN addressing, and DHCP configuration to any network-reachable attacker without credentials. The getWanIeCfg CGI function accepts POST requests at /cgi-bin/cstecgi.cgi without enforcing access control, returning network topology data that can directly support further reconnaissance or targeted attacks. No public exploit has been identified at time of analysis; EPSS at 0.18% (7th percentile) and SSVC Exploitation: none both indicate no observed active threat activity.
Unauthenticated denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force an arbitrary device reboot by publishing a crafted MQTT message that reaches the internal startSlaveReboot handler, which performs no access-control check. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile). The impact is loss of availability rather than the code execution or data theft implied by the assigned CVSS 9.8.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve sensitive device initialization configuration by sending a crafted POST request to the `/cgi-bin/cstecgi.cgi` endpoint without credentials. The `getInitCfg` handler performs no access control checks before returning configuration data, confirmed by a CVSS PR:N vector. Despite a CVSS score of 7.5, exploitation likelihood is low - EPSS sits at 0.18% (7th percentile) and SSVC reports no observed exploitation - though the attack is fully automatable with no user interaction required.
Unauthenticated network topology and interface configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with access to the device's web management interface to retrieve sensitive network layout data without credentials. The getNetInfoCfg function in /cgi-bin/cstecgi.cgi enforces no access control, so a single crafted POST request returns interface and topology details that support downstream reconnaissance and targeted follow-on attacks. No public exploit code is confirmed and EPSS sits at 0.18% (7th percentile), but SOHO routers are frequently internet-exposed with factory defaults intact, elevating practical risk above what EPSS alone implies.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.
Unauthenticated online client enumeration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected device information to any attacker who can reach the router's HTTP management interface. The getOnlineClient function within the /cgi-bin/cstecgi.cgi CGI dispatcher applies no access control, so a crafted POST request returns the router's live client inventory without credentials. No public exploit has been identified at time of analysis and the EPSS score sits at 0.18% (7th percentile), indicating this is not being exploited at scale - consistent with a batch of researcher-coordinated disclosures across multiple T6 CGI endpoints rather than active threat actor campaigns.
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
Unauthenticated network access to the getCloudSrvCheckStatus function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware check status information to any remote attacker who sends a crafted POST to /cgi-bin/cstecgi.cgi. The CWE-284 improper access control flaw requires no credentials or session token, though the leaked data - firmware update check status - is of modest sensitivity compared to credentials or full configuration disclosure. No public exploit code has been independently confirmed; technical details are publicly available via researcher coordination repositories, and EPSS at 0.18% reflects limited observed exploitation pressure at this time.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh routing table data through the getMeshRoutingTable CGI function. An attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve internal mesh routing topology without any credentials. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.18%, though GitHub-hosted CVE coordination repositories suggest researcher awareness and POC development activity.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's parental-control rules by sending a crafted POST request to the getParentalRules handler on /cgi-bin/cstecgi.cgi. The endpoint lacks any access-control check, so no credentials are required. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) indicates minimal current exploitation interest.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's WPS configuration - including the active WPS PIN - by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the getWiFiWpsCfg handler performs no access-control check, any party who can reach the web interface can harvest the PIN and use it to derive the Wi-Fi passphrase and join the network. No public exploit identified at time of analysis and EPSS is low (0.18%), but the trivial, network-reachable nature of the flaw makes it high-value against exposed devices.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected client MAC addresses to any remote attacker via the getStationMacByIp CGI function. The /cgi-bin/cstecgi.cgi endpoint processes crafted POST requests without enforcing any access control, returning MAC address data that can enable network reconnaissance and bypass of MAC-based access filtering. No confirmed active exploitation or CISA KEV listing exists, and EPSS probability is negligible at 0.18%, though the fully unauthenticated network vector makes automated scanning trivial.
Unauthenticated information exposure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the getWiFiApcliScan handler via /cgi-bin/cstecgi.cgi to force a wireless scan and read back AP-client scan results without any credentials. The flaw is an incorrect access-control (CWE-284) gap: the CGI endpoint does not verify authentication before executing the scan. No public exploit is identified and EPSS is low (0.18%), though SSVC rates the action as automatable with total technical impact per CISA's framework.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes DDNS runtime status and the router's public IP address to any network-reachable attacker. The getDdnsStatus function in the CGI interface fails to enforce access control, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return sensitive network configuration without credentials. No active exploitation is confirmed (CISA KEV absent, EPSS at 0.18%), though SSVC notes the attack is automatable with no required privileges or user interaction.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Wi-Fi credentials - including SSIDs and plaintext Wi-Fi keys - to any attacker on the network or internet who can reach the device's web interface. The getWiFiEasyCfg function in the CGI handler accepts POST requests without enforcing authentication, classifying this as CWE-284 improper access control rather than a logic bypass. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but two independent researcher disclosure repositories on GitHub reference this CVE, consistent with coordinated disclosure that may include proof-of-concept detail.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the router's DMZ configuration to any network-reachable attacker. The getDmzCfg function in /cgi-bin/cstecgi.cgi fails to enforce access controls, allowing crafted POST requests to return DMZ host mappings and related network settings without credentials. No active exploitation is confirmed (absent from CISA KEV), though GitHub vendor-coordination repositories indicate researcher involvement and potential public disclosure of attack methodology.
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no credentials, switching on administrative services that should stay restricted and opening a path to unauthorized device access. Tracked as CVE-2026-78239 and published in CISA ICS advisory ICSA-26-239-01, it carries a CVSS 4.0 base score of 9.3 (critical). No public exploit is identified at time of analysis, and the device is not listed in CISA KEV.
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Unauthenticated access to PayRange API management endpoints exposes verbose device details for every device on the PayRange network, exploitable with or without a registered account. Classified under CWE-862 (Missing Authorization) and reported by CISA ICS-CERT as advisory ICSA-26-237-04, the flaw affects all tracked versions of the PayRange API with a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, though the network-accessible nature and low attack complexity make this a low-effort target for reconnaissance against PayRange-managed payment infrastructure.
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2.
Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Unauthenticated remote command execution affects the @agent-infra MCP servers shipped with ByteDance's UI-TARS-desktop, whose shared mcp-http-server helper defaulted its bind address to '::' (all interfaces) and only enforced authentication when a caller explicitly passed middleware. Because the commands and filesystem server entry points call startSseAndStreamableHttpMcpServer with only a host and port and no middleware, any client that can reach the listening port can invoke the run_command tool (routed to child_process.exec) or the file read/write tools with no credential. Reported by VulnCheck and rated CVSS 4.0 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in the email field of an imported identity document, rewriting the terminal line that displays a key fingerprint. A remote, unauthenticated attacker who delivers a crafted identity bundle via normal contact-exchange or keyserver flows can make the tool render a fraudulent fingerprint, defeating the out-of-band verification that guards against key-substitution (MITM) attacks. No public exploit is identified at time of analysis and it is not on CISA KEV.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
Authentication bypass in the jahlives openssl_encrypt library (versions before 1.4.9) permits remote attackers to craft files containing unencrypted post-quantum cryptography (PQC) private keys in file metadata that the library accepts and decrypts successfully under any supplied password. Because the library never validates whether embedded PQC keys are actually encrypted, an adversary controls the decrypted plaintext output entirely while the library simultaneously produces a false positive integrity verification signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 8.7 with a network-reachable, unauthenticated, zero-complexity attack surface makes patching urgent for any deployment processing untrusted encrypted files.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Unauthenticated data disclosure in Baserow's Application Builder exposes all configured data source records to any caller due to a discarded permission check result. The dispatch and record-name API views accept requests from unauthenticated callers, and the underlying service calls `check_multiple_permissions` without requesting it to raise on denial - the returned denial mapping is silently ignored, allowing execution to proceed and the data source to be dispatched using the integration's own stored credentials. Because data source identifiers are sequential integers, any network-reachable attacker can enumerate all Application Builder data sources and retrieve every row and field they expose. No public exploit has been identified at time of analysis.
Authentication bypass in the Telnyx MCP server (team-telnyx/telnyx-node, through 6.83.0) lets any network-reachable caller invoke MCP tools with no credential. The Streamable HTTP transport bound to all interfaces and parsed auth headers in a non-failing mode, so a request lacking credentials still completed initialisation and dispatched tools - which then forwarded the server's own stored Telnyx API key, client secret, and code-execution key upstream. Reported by VulnCheck with CVSS 4.0 9.3; no public exploit identified at time of analysis.
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the `serve` command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the `--token` flag, so a normal `mcpr-cli serve ...` invocation published the aggregator unauthenticated to the entire network. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit code or active-exploitation reporting is identified at time of analysis.
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform unauthorized operations on tasks belonging to cases they do not own. Flowintel versions >= 3.3.0 accept a case ID and task ID pair on task-related routes but previously failed to verify that the referenced task actually belonged to the supplied case, enabling cross-case data access and manipulation. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.2 reflects high integrity impact - affected operations include task editing, deletion, note management, file handling, assignment, MISP-linking, and export.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode.
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode.
Price manipulation in the StoreGrowth WordPress plugin (versions before 2.1.2) enables unauthenticated attackers to add products to a WooCommerce cart at arbitrary, attacker-chosen prices that carry through to checkout totals - directly enabling financial fraud against affected merchants. The flaw exists across two unauthenticated AJAX actions that accept browser-supplied price values without any server-side validation, and is conditional on the BOGO (Buy One Get One) promotional feature being active. No public exploit code has been identified, and EPSS is low at 0.18% (8th percentile), though SSVC rates the attack as automatable - making mass scanning of vulnerable stores feasible.
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Missing authorization on the /storage/upload endpoint in cjbi admin3 v3.0.0 permits any authenticated user - regardless of role or privilege level - to upload arbitrary files to the server. Compounding this, the storage endpoint exposes uploaded files for unauthenticated anonymous download, creating a two-stage attack surface: an authenticated insider or low-privilege account uploads a malicious payload, which any external anonymous actor can then retrieve. No public exploit identified at time of analysis beyond researcher documentation on GitHub, and EPSS sits at 0.15% despite the high CVSS score, indicating limited observed exploitation at this time.
Incorrect access control in Veno File Manager 4.4.9 exposes the admin-head-updates.php component without proper authorization enforcement, allowing remote attackers to reach administrative update-handling functionality that should be restricted to authenticated administrators. A public proof-of-concept exists on GitHub (jfs-jfs/CVE-2026-37072), but the vulnerability is not listed in CISA KEV and carries a low EPSS score (0.16%, 5th percentile). The upstream CVSS of 9.8 (full C:H/I:H/A:H) appears aggressive relative to the thin one-line description, which names only an access-control defect in an update-header script rather than a confirmed code-execution or full-compromise path.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
Unauthenticated configuration disclosure in Baidu disconf 2.6.36 lets any anonymous network attacker read every configuration item and file managed by the config center. The LoginInterceptor whitelists four config-fetching endpoints (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list), bypassing authentication entirely. SSVC records a public proof-of-concept and full technical impact; EPSS is currently low (0.17%, 6th percentile), and there is no public exploit identified as actively exploited in the wild.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to overwrite objects outside their permission scope. Versions prior to 4.40 compute the write-back directory from the bucket root rather than the actual parent directory of the nested key, meaning a principal scoped to `allowed/protected.txt` silently overwrites `protected.txt` at the bucket root - clobbering its content, metadata, owner, and ACL. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV.
Authorization state-confusion in Simple Machines Forum (SMF) through version 2.1.7 enables any authenticated low-privileged user to escalate privileges to administrator without possessing admin credentials. The vulnerability stems from a mismatch between Profile::$member and User::$me->is_owner during sequential profile loading when multiple values are supplied for the user parameter, tricking the application into treating the attacker as the owner of an administrator profile and granting access to password-change functionality. No CISA KEV listing or confirmed public exploit code exists at time of analysis, but the CVSS 4.0 score of 8.6, low attack complexity, and minimal authentication barrier - any registered user qualifies - make this a critical priority for all SMF operators.
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to cross configured ACL boundaries and access or overwrite sibling tenants' files. The SFTP permission check used a bare string-prefix comparison, so a user scoped to /tenants/alice was also permitted access to any path beginning with those same characters - such as /tenants/alice-archive or /tenants/alice2 - without requiring a directory-component boundary. No public exploit code has been identified at time of analysis, though the public fix commit and advisory together fully document the vulnerable pattern, materially lowering exploitation difficulty for authenticated users.
Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting panel customer to read and overwrite databases belonging to other customers on the same server, affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity, consistent with the description: a valid tenant account and knowledge of another tenant's database identifier are all that is required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the multi-tenant hosting context amplifies real-world impact significantly.
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles they are explicitly denied through the standard STS path. The S3 API's direct bearer token authentication path validates the OIDC JWT signature but skips trust policy enforcement, which the STS AssumeRoleWithWebIdentity path correctly applies. A federated user with a valid OIDC token can present it directly to the S3 API and obtain the mapped role's full S3 permissions - including object read, write, and delete - even when the role's trust policy explicitly rejects their identity provider. Version 4.40 patches the issue; no public exploit code has been identified at time of analysis.
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operations against existing sessions, enabling a low-privilege authenticated tenant to hijack cross-tenant upload sessions. An attacker holding a valid but restricted JWT token can PATCH arbitrary content into another tenant's in-progress upload by reusing the victim's session ID, causing the completed file to land at a filesystem path the attacker's token explicitly forbids. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 4.40.
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged attacker to bypass authorization controls and gain unauthorized access to the backup and recovery environment. The CVSS 8.8 High score reflects network-accessible exploitation with low attack complexity (AV:N/AC:L/PR:L), and full confidentiality, integrity, and availability impact - suggesting the attacker can read, modify, or destroy vaulted backup data. Vendor patch version 20.3.0.0 is available via Dell Security Advisory DSA-2026-370; no active exploitation has been confirmed in CISA KEV and EPSS indicates low current exploitation probability.
Frappe's REST API before v15.115.0 contains an access control bypass (CWE-863) that allows any low-privileged authenticated user to read fields from Linked DocType records outside their permitted scope. When a document is fetched via the REST API, the framework resolves Link field references to other DocTypes but inconsistently re-applies the linked DocType's own permission rules, enabling horizontal data leakage across role boundaries. No confirmed active exploitation or public exploit code has been identified, but the low attack complexity and network-accessible vector create meaningful data exfiltration risk in multi-role or multi-tenant Frappe/ERPNext deployments.
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allowing any authenticated low-privilege user to assign unauthorized projects or workspaces to a team via the API. The root serializer field `defining_workspace` resolved primary keys against `Workspace.objects.all()` without filtering by the requesting user's permissions, enabling horizontal privilege escalation to private projects. Vendor-released patch 2026.7 is confirmed; no public exploit code or CISA KEV listing exists at time of analysis.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware.
WebAuthn user verification bypass in Spring Security exposes applications to authentication circumvention when a distributed HTTP session store is in use. Affected versions span Spring Security 6.4.x through 7.1.0, meaning a broad range of enterprise Spring Boot applications leveraging passwordless/FIDO2 authentication are at risk. An unauthenticated remote attacker with the ability to manipulate the WebAuthn ceremony flow can bypass the user verification check - potentially authenticating as a legitimate user - with no public exploit identified at time of analysis.
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Team deletion in Midday's tRPC API grants destructive Owner-equivalent authority to any authenticated Member due to a missing role check in `apps/api/src/trpc/routers/team.ts`. The `team-access` authorization helper confirms team membership but never validates whether the caller holds the `owner` role, despite that check being correctly implemented in adjacent member-removal and member-update procedures within the same router. Any invited team member - receiving the `Member` role by default - can delete the entire team and all scoped records, and additionally trigger a background cleanup job that exercises stored bank-connection OAuth tokens against connected financial providers. No public exploit identified at time of analysis; no CISA KEV listing.
Unauthenticated disclosure and modification of runtime configuration in NebulaGraph (vesoft-inc nebula) through version 3.8.0 lets any network-reachable attacker read and rewrite daemon gflags via the built-in web service. Because the service in src/webservice/WebService.cpp binds to all interfaces with no authentication, token, or address restriction, an attacker can harvest sensitive paths (certificate, key, CA, and password-file locations) and disable transport-security flags, redirect logging, and weaken lockout controls without a restart. No public exploit is identified at time of analysis, but the flaw is trivial to trigger and was reported by VulnCheck.
Insecure Direct Object Reference in IDURAR ERP CRM through v4.1.1 allows any authenticated administrator to overwrite the password of any other administrator account by supplying an arbitrary account identifier in the URL path of the password-update endpoint. The backend handler resolves the target account from the caller-controlled path parameter rather than the session token, and the two are never compared, enabling full account takeover of peer administrators. No public exploit has been identified at time of analysis, but the logic flaw is mechanically straightforward for any holder of a valid administrator token.
Channel-pinning authorization bypass in one-api through v0.6.10 allows any holder of a valid API token to route requests through arbitrary operator-configured upstream provider channels they were never granted access to. The flaw exists because middleware/auth.go implements two channel-selection paths - a key-suffix path correctly gated by an admin role check, and a URL path parameter path (channelid) carrying no role check at all - so a low-privilege account can enumerate integer channel IDs and cause the server to forward requests bearing provider API keys (e.g., OpenAI, Anthropic) configured by the operator. The bypass defeats both per-group channel restrictions and per-channel model allowlists. No public exploit has been identified at time of analysis, but the integer-enumeration primitive is trivially reproducible from the description alone.
Memory safety flaws in the Linux kernel s390/zcrypt EP11 CPRB domain handler allow a local low-privileged user on IBM Z mainframe systems to achieve full privilege escalation via crafted cryptographic request blocks. The vulnerable function zcrypt_msgtype6_send_ep11_cprb() uses struct overlays to access EP11 payload domain fields without performing ASN.1 validation or bounds checks at each parsing step, creating conditions for out-of-bounds memory access and incorrect domain field manipulation - the latter consistent with the intelligence-tagged 'Authentication Bypass' impact on EP11 coprocessor domain isolation. Vendor-released patches are available in Linux 7.1.10 and 7.2; no public exploit code or CISA KEV confirmation has been identified at time of analysis.
Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy in their own namespace force the cluster-privileged admission controller to generate resources (ConfigMaps, Secrets, NetworkPolicies, RoleBindings) in arbitrary namespaces, including kube-system. The nmpol CEL compiler unintentionally exposes the generator library to matchConditions, and neither the mpol validator nor GenerateResources enforces namespace scope on the generator.apply() target. A working proof-of-concept is published in the vendor advisory (GHSA-79gf-7frw-68m9); there is no KEV listing or evidence of active exploitation, and the issue is fixed in 1.18.2.
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Turkey's national CERT (TR-CERT).
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
Hard-coded HMAC credential exposure in Resamania's Virtuagym mobile application allows a low-privileged attacker to forge unlimited physical access QR codes, bypassing facility entry controls permanently. The static HMAC key - derived from the badge_number parameter - is retrievable via an authenticated API call, and the QR code generation logic can be extracted by reverse engineering the unobfuscated APK. Generated codes remain valid indefinitely regardless of subsequent password changes or session logouts, meaning revocation of legitimate access does not invalidate attacker-forged credentials. No public exploit has been identified at time of analysis, though the low technical barrier significantly elevates practical exploitability.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privilege credentials to gain full control of the underlying host device through an improper access control flaw. Ubiquiti self-reported the issue and rates it CVSS 9.9 (scope-changing), reflecting that a constrained application account can break out to compromise the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti's UniFi Connect Display Cast Pro lets a network-adjacent attacker abuse an improper access-control flaw to gain elevated rights on the device under certain conditions. The issue was reported by Ubiquiti and disclosed in Security Advisory Bulletin 067; it is tagged as an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the vendor-assigned CVSS of 9.0 marks it as critical.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Unauthenticated remote access to setup wizard and onboarding configuration is possible on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 through missing access control on the getWizardCfg CGI handler. Any attacker reachable to the device's web management interface can send a crafted POST to /cgi-bin/cstecgi.cgi and receive wizard configuration data - which may include ISP connection parameters or other sensitive values collected during initial device setup - without supplying credentials. No active exploitation has been identified (EPSS 0.18%, 7th percentile; not in CISA KEV), and disclosure follows a researcher-coordinated process documented on GitHub.
Unauthenticated LAN and DHCP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve internal network topology data by sending a crafted POST request to /cgi-bin/cstecgi.cgi without any credentials. The getLanCfg CGI handler applies no access control before returning LAN addressing and DHCP server configuration. EPSS at 0.18% (7th percentile) and SSVC 'Exploitation: none' confirm no observed active exploitation; no CISA KEV listing or public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN interface, LAN addressing, and DHCP configuration to any network-reachable attacker without credentials. The getWanIeCfg CGI function accepts POST requests at /cgi-bin/cstecgi.cgi without enforcing access control, returning network topology data that can directly support further reconnaissance or targeted attacks. No public exploit has been identified at time of analysis; EPSS at 0.18% (7th percentile) and SSVC Exploitation: none both indicate no observed active threat activity.
Unauthenticated denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force an arbitrary device reboot by publishing a crafted MQTT message that reaches the internal startSlaveReboot handler, which performs no access-control check. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile). The impact is loss of availability rather than the code execution or data theft implied by the assigned CVSS 9.8.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve sensitive device initialization configuration by sending a crafted POST request to the `/cgi-bin/cstecgi.cgi` endpoint without credentials. The `getInitCfg` handler performs no access control checks before returning configuration data, confirmed by a CVSS PR:N vector. Despite a CVSS score of 7.5, exploitation likelihood is low - EPSS sits at 0.18% (7th percentile) and SSVC reports no observed exploitation - though the attack is fully automatable with no user interaction required.
Unauthenticated network topology and interface configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with access to the device's web management interface to retrieve sensitive network layout data without credentials. The getNetInfoCfg function in /cgi-bin/cstecgi.cgi enforces no access control, so a single crafted POST request returns interface and topology details that support downstream reconnaissance and targeted follow-on attacks. No public exploit code is confirmed and EPSS sits at 0.18% (7th percentile), but SOHO routers are frequently internet-exposed with factory defaults intact, elevating practical risk above what EPSS alone implies.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.
Unauthenticated online client enumeration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected device information to any attacker who can reach the router's HTTP management interface. The getOnlineClient function within the /cgi-bin/cstecgi.cgi CGI dispatcher applies no access control, so a crafted POST request returns the router's live client inventory without credentials. No public exploit has been identified at time of analysis and the EPSS score sits at 0.18% (7th percentile), indicating this is not being exploited at scale - consistent with a batch of researcher-coordinated disclosures across multiple T6 CGI endpoints rather than active threat actor campaigns.
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
Unauthenticated network access to the getCloudSrvCheckStatus function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware check status information to any remote attacker who sends a crafted POST to /cgi-bin/cstecgi.cgi. The CWE-284 improper access control flaw requires no credentials or session token, though the leaked data - firmware update check status - is of modest sensitivity compared to credentials or full configuration disclosure. No public exploit code has been independently confirmed; technical details are publicly available via researcher coordination repositories, and EPSS at 0.18% reflects limited observed exploitation pressure at this time.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh routing table data through the getMeshRoutingTable CGI function. An attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve internal mesh routing topology without any credentials. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.18%, though GitHub-hosted CVE coordination repositories suggest researcher awareness and POC development activity.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's parental-control rules by sending a crafted POST request to the getParentalRules handler on /cgi-bin/cstecgi.cgi. The endpoint lacks any access-control check, so no credentials are required. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) indicates minimal current exploitation interest.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's WPS configuration - including the active WPS PIN - by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the getWiFiWpsCfg handler performs no access-control check, any party who can reach the web interface can harvest the PIN and use it to derive the Wi-Fi passphrase and join the network. No public exploit identified at time of analysis and EPSS is low (0.18%), but the trivial, network-reachable nature of the flaw makes it high-value against exposed devices.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected client MAC addresses to any remote attacker via the getStationMacByIp CGI function. The /cgi-bin/cstecgi.cgi endpoint processes crafted POST requests without enforcing any access control, returning MAC address data that can enable network reconnaissance and bypass of MAC-based access filtering. No confirmed active exploitation or CISA KEV listing exists, and EPSS probability is negligible at 0.18%, though the fully unauthenticated network vector makes automated scanning trivial.
Unauthenticated information exposure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the getWiFiApcliScan handler via /cgi-bin/cstecgi.cgi to force a wireless scan and read back AP-client scan results without any credentials. The flaw is an incorrect access-control (CWE-284) gap: the CGI endpoint does not verify authentication before executing the scan. No public exploit is identified and EPSS is low (0.18%), though SSVC rates the action as automatable with total technical impact per CISA's framework.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes DDNS runtime status and the router's public IP address to any network-reachable attacker. The getDdnsStatus function in the CGI interface fails to enforce access control, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return sensitive network configuration without credentials. No active exploitation is confirmed (CISA KEV absent, EPSS at 0.18%), though SSVC notes the attack is automatable with no required privileges or user interaction.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Wi-Fi credentials - including SSIDs and plaintext Wi-Fi keys - to any attacker on the network or internet who can reach the device's web interface. The getWiFiEasyCfg function in the CGI handler accepts POST requests without enforcing authentication, classifying this as CWE-284 improper access control rather than a logic bypass. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but two independent researcher disclosure repositories on GitHub reference this CVE, consistent with coordinated disclosure that may include proof-of-concept detail.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the router's DMZ configuration to any network-reachable attacker. The getDmzCfg function in /cgi-bin/cstecgi.cgi fails to enforce access controls, allowing crafted POST requests to return DMZ host mappings and related network settings without credentials. No active exploitation is confirmed (absent from CISA KEV), though GitHub vendor-coordination repositories indicate researcher involvement and potential public disclosure of attack methodology.
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no credentials, switching on administrative services that should stay restricted and opening a path to unauthorized device access. Tracked as CVE-2026-78239 and published in CISA ICS advisory ICSA-26-239-01, it carries a CVSS 4.0 base score of 9.3 (critical). No public exploit is identified at time of analysis, and the device is not listed in CISA KEV.
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Unauthenticated access to PayRange API management endpoints exposes verbose device details for every device on the PayRange network, exploitable with or without a registered account. Classified under CWE-862 (Missing Authorization) and reported by CISA ICS-CERT as advisory ICSA-26-237-04, the flaw affects all tracked versions of the PayRange API with a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, though the network-accessible nature and low attack complexity make this a low-effort target for reconnaissance against PayRange-managed payment infrastructure.
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2.
Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Unauthenticated remote command execution affects the @agent-infra MCP servers shipped with ByteDance's UI-TARS-desktop, whose shared mcp-http-server helper defaulted its bind address to '::' (all interfaces) and only enforced authentication when a caller explicitly passed middleware. Because the commands and filesystem server entry points call startSseAndStreamableHttpMcpServer with only a host and port and no middleware, any client that can reach the listening port can invoke the run_command tool (routed to child_process.exec) or the file read/write tools with no credential. Reported by VulnCheck and rated CVSS 4.0 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in the email field of an imported identity document, rewriting the terminal line that displays a key fingerprint. A remote, unauthenticated attacker who delivers a crafted identity bundle via normal contact-exchange or keyserver flows can make the tool render a fraudulent fingerprint, defeating the out-of-band verification that guards against key-substitution (MITM) attacks. No public exploit is identified at time of analysis and it is not on CISA KEV.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
Authentication bypass in the jahlives openssl_encrypt library (versions before 1.4.9) permits remote attackers to craft files containing unencrypted post-quantum cryptography (PQC) private keys in file metadata that the library accepts and decrypts successfully under any supplied password. Because the library never validates whether embedded PQC keys are actually encrypted, an adversary controls the decrypted plaintext output entirely while the library simultaneously produces a false positive integrity verification signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 8.7 with a network-reachable, unauthenticated, zero-complexity attack surface makes patching urgent for any deployment processing untrusted encrypted files.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Unauthenticated data disclosure in Baserow's Application Builder exposes all configured data source records to any caller due to a discarded permission check result. The dispatch and record-name API views accept requests from unauthenticated callers, and the underlying service calls `check_multiple_permissions` without requesting it to raise on denial - the returned denial mapping is silently ignored, allowing execution to proceed and the data source to be dispatched using the integration's own stored credentials. Because data source identifiers are sequential integers, any network-reachable attacker can enumerate all Application Builder data sources and retrieve every row and field they expose. No public exploit has been identified at time of analysis.
Authentication bypass in the Telnyx MCP server (team-telnyx/telnyx-node, through 6.83.0) lets any network-reachable caller invoke MCP tools with no credential. The Streamable HTTP transport bound to all interfaces and parsed auth headers in a non-failing mode, so a request lacking credentials still completed initialisation and dispatched tools - which then forwarded the server's own stored Telnyx API key, client secret, and code-execution key upstream. Reported by VulnCheck with CVSS 4.0 9.3; no public exploit identified at time of analysis.
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the `serve` command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the `--token` flag, so a normal `mcpr-cli serve ...` invocation published the aggregator unauthenticated to the entire network. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit code or active-exploitation reporting is identified at time of analysis.
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform unauthorized operations on tasks belonging to cases they do not own. Flowintel versions >= 3.3.0 accept a case ID and task ID pair on task-related routes but previously failed to verify that the referenced task actually belonged to the supplied case, enabling cross-case data access and manipulation. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.2 reflects high integrity impact - affected operations include task editing, deletion, note management, file handling, assignment, MISP-linking, and export.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode.
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode.
Price manipulation in the StoreGrowth WordPress plugin (versions before 2.1.2) enables unauthenticated attackers to add products to a WooCommerce cart at arbitrary, attacker-chosen prices that carry through to checkout totals - directly enabling financial fraud against affected merchants. The flaw exists across two unauthenticated AJAX actions that accept browser-supplied price values without any server-side validation, and is conditional on the BOGO (Buy One Get One) promotional feature being active. No public exploit code has been identified, and EPSS is low at 0.18% (8th percentile), though SSVC rates the attack as automatable - making mass scanning of vulnerable stores feasible.
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Missing authorization on the /storage/upload endpoint in cjbi admin3 v3.0.0 permits any authenticated user - regardless of role or privilege level - to upload arbitrary files to the server. Compounding this, the storage endpoint exposes uploaded files for unauthenticated anonymous download, creating a two-stage attack surface: an authenticated insider or low-privilege account uploads a malicious payload, which any external anonymous actor can then retrieve. No public exploit identified at time of analysis beyond researcher documentation on GitHub, and EPSS sits at 0.15% despite the high CVSS score, indicating limited observed exploitation at this time.
Incorrect access control in Veno File Manager 4.4.9 exposes the admin-head-updates.php component without proper authorization enforcement, allowing remote attackers to reach administrative update-handling functionality that should be restricted to authenticated administrators. A public proof-of-concept exists on GitHub (jfs-jfs/CVE-2026-37072), but the vulnerability is not listed in CISA KEV and carries a low EPSS score (0.16%, 5th percentile). The upstream CVSS of 9.8 (full C:H/I:H/A:H) appears aggressive relative to the thin one-line description, which names only an access-control defect in an update-header script rather than a confirmed code-execution or full-compromise path.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
Unauthenticated configuration disclosure in Baidu disconf 2.6.36 lets any anonymous network attacker read every configuration item and file managed by the config center. The LoginInterceptor whitelists four config-fetching endpoints (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list), bypassing authentication entirely. SSVC records a public proof-of-concept and full technical impact; EPSS is currently low (0.17%, 6th percentile), and there is no public exploit identified as actively exploited in the wild.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to overwrite objects outside their permission scope. Versions prior to 4.40 compute the write-back directory from the bucket root rather than the actual parent directory of the nested key, meaning a principal scoped to `allowed/protected.txt` silently overwrites `protected.txt` at the bucket root - clobbering its content, metadata, owner, and ACL. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV.
Authorization state-confusion in Simple Machines Forum (SMF) through version 2.1.7 enables any authenticated low-privileged user to escalate privileges to administrator without possessing admin credentials. The vulnerability stems from a mismatch between Profile::$member and User::$me->is_owner during sequential profile loading when multiple values are supplied for the user parameter, tricking the application into treating the attacker as the owner of an administrator profile and granting access to password-change functionality. No CISA KEV listing or confirmed public exploit code exists at time of analysis, but the CVSS 4.0 score of 8.6, low attack complexity, and minimal authentication barrier - any registered user qualifies - make this a critical priority for all SMF operators.
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to cross configured ACL boundaries and access or overwrite sibling tenants' files. The SFTP permission check used a bare string-prefix comparison, so a user scoped to /tenants/alice was also permitted access to any path beginning with those same characters - such as /tenants/alice-archive or /tenants/alice2 - without requiring a directory-component boundary. No public exploit code has been identified at time of analysis, though the public fix commit and advisory together fully document the vulnerable pattern, materially lowering exploitation difficulty for authenticated users.
Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting panel customer to read and overwrite databases belonging to other customers on the same server, affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity, consistent with the description: a valid tenant account and knowledge of another tenant's database identifier are all that is required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the multi-tenant hosting context amplifies real-world impact significantly.
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles they are explicitly denied through the standard STS path. The S3 API's direct bearer token authentication path validates the OIDC JWT signature but skips trust policy enforcement, which the STS AssumeRoleWithWebIdentity path correctly applies. A federated user with a valid OIDC token can present it directly to the S3 API and obtain the mapped role's full S3 permissions - including object read, write, and delete - even when the role's trust policy explicitly rejects their identity provider. Version 4.40 patches the issue; no public exploit code has been identified at time of analysis.
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operations against existing sessions, enabling a low-privilege authenticated tenant to hijack cross-tenant upload sessions. An attacker holding a valid but restricted JWT token can PATCH arbitrary content into another tenant's in-progress upload by reusing the victim's session ID, causing the completed file to land at a filesystem path the attacker's token explicitly forbids. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 4.40.
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged attacker to bypass authorization controls and gain unauthorized access to the backup and recovery environment. The CVSS 8.8 High score reflects network-accessible exploitation with low attack complexity (AV:N/AC:L/PR:L), and full confidentiality, integrity, and availability impact - suggesting the attacker can read, modify, or destroy vaulted backup data. Vendor patch version 20.3.0.0 is available via Dell Security Advisory DSA-2026-370; no active exploitation has been confirmed in CISA KEV and EPSS indicates low current exploitation probability.
Frappe's REST API before v15.115.0 contains an access control bypass (CWE-863) that allows any low-privileged authenticated user to read fields from Linked DocType records outside their permitted scope. When a document is fetched via the REST API, the framework resolves Link field references to other DocTypes but inconsistently re-applies the linked DocType's own permission rules, enabling horizontal data leakage across role boundaries. No confirmed active exploitation or public exploit code has been identified, but the low attack complexity and network-accessible vector create meaningful data exfiltration risk in multi-role or multi-tenant Frappe/ERPNext deployments.
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allowing any authenticated low-privilege user to assign unauthorized projects or workspaces to a team via the API. The root serializer field `defining_workspace` resolved primary keys against `Workspace.objects.all()` without filtering by the requesting user's permissions, enabling horizontal privilege escalation to private projects. Vendor-released patch 2026.7 is confirmed; no public exploit code or CISA KEV listing exists at time of analysis.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware.
WebAuthn user verification bypass in Spring Security exposes applications to authentication circumvention when a distributed HTTP session store is in use. Affected versions span Spring Security 6.4.x through 7.1.0, meaning a broad range of enterprise Spring Boot applications leveraging passwordless/FIDO2 authentication are at risk. An unauthenticated remote attacker with the ability to manipulate the WebAuthn ceremony flow can bypass the user verification check - potentially authenticating as a legitimate user - with no public exploit identified at time of analysis.
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Team deletion in Midday's tRPC API grants destructive Owner-equivalent authority to any authenticated Member due to a missing role check in `apps/api/src/trpc/routers/team.ts`. The `team-access` authorization helper confirms team membership but never validates whether the caller holds the `owner` role, despite that check being correctly implemented in adjacent member-removal and member-update procedures within the same router. Any invited team member - receiving the `Member` role by default - can delete the entire team and all scoped records, and additionally trigger a background cleanup job that exercises stored bank-connection OAuth tokens against connected financial providers. No public exploit identified at time of analysis; no CISA KEV listing.
Unauthenticated disclosure and modification of runtime configuration in NebulaGraph (vesoft-inc nebula) through version 3.8.0 lets any network-reachable attacker read and rewrite daemon gflags via the built-in web service. Because the service in src/webservice/WebService.cpp binds to all interfaces with no authentication, token, or address restriction, an attacker can harvest sensitive paths (certificate, key, CA, and password-file locations) and disable transport-security flags, redirect logging, and weaken lockout controls without a restart. No public exploit is identified at time of analysis, but the flaw is trivial to trigger and was reported by VulnCheck.
Insecure Direct Object Reference in IDURAR ERP CRM through v4.1.1 allows any authenticated administrator to overwrite the password of any other administrator account by supplying an arbitrary account identifier in the URL path of the password-update endpoint. The backend handler resolves the target account from the caller-controlled path parameter rather than the session token, and the two are never compared, enabling full account takeover of peer administrators. No public exploit has been identified at time of analysis, but the logic flaw is mechanically straightforward for any holder of a valid administrator token.
Channel-pinning authorization bypass in one-api through v0.6.10 allows any holder of a valid API token to route requests through arbitrary operator-configured upstream provider channels they were never granted access to. The flaw exists because middleware/auth.go implements two channel-selection paths - a key-suffix path correctly gated by an admin role check, and a URL path parameter path (channelid) carrying no role check at all - so a low-privilege account can enumerate integer channel IDs and cause the server to forward requests bearing provider API keys (e.g., OpenAI, Anthropic) configured by the operator. The bypass defeats both per-group channel restrictions and per-channel model allowlists. No public exploit has been identified at time of analysis, but the integer-enumeration primitive is trivially reproducible from the description alone.
Memory safety flaws in the Linux kernel s390/zcrypt EP11 CPRB domain handler allow a local low-privileged user on IBM Z mainframe systems to achieve full privilege escalation via crafted cryptographic request blocks. The vulnerable function zcrypt_msgtype6_send_ep11_cprb() uses struct overlays to access EP11 payload domain fields without performing ASN.1 validation or bounds checks at each parsing step, creating conditions for out-of-bounds memory access and incorrect domain field manipulation - the latter consistent with the intelligence-tagged 'Authentication Bypass' impact on EP11 coprocessor domain isolation. Vendor-released patches are available in Linux 7.1.10 and 7.2; no public exploit code or CISA KEV confirmation has been identified at time of analysis.
Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy in their own namespace force the cluster-privileged admission controller to generate resources (ConfigMaps, Secrets, NetworkPolicies, RoleBindings) in arbitrary namespaces, including kube-system. The nmpol CEL compiler unintentionally exposes the generator library to matchConditions, and neither the mpol validator nor GenerateResources enforces namespace scope on the generator.apply() target. A working proof-of-concept is published in the vendor advisory (GHSA-79gf-7frw-68m9); there is no KEV listing or evidence of active exploitation, and the issue is fixed in 1.18.2.
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Turkey's national CERT (TR-CERT).
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
Hard-coded HMAC credential exposure in Resamania's Virtuagym mobile application allows a low-privileged attacker to forge unlimited physical access QR codes, bypassing facility entry controls permanently. The static HMAC key - derived from the badge_number parameter - is retrievable via an authenticated API call, and the QR code generation logic can be extracted by reverse engineering the unobfuscated APK. Generated codes remain valid indefinitely regardless of subsequent password changes or session logouts, meaning revocation of legitimate access does not invalidate attacker-forged credentials. No public exploit has been identified at time of analysis, though the low technical barrier significantly elevates practical exploitability.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privilege credentials to gain full control of the underlying host device through an improper access control flaw. Ubiquiti self-reported the issue and rates it CVSS 9.9 (scope-changing), reflecting that a constrained application account can break out to compromise the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti's UniFi Connect Display Cast Pro lets a network-adjacent attacker abuse an improper access-control flaw to gain elevated rights on the device under certain conditions. The issue was reported by Ubiquiti and disclosed in Security Advisory Bulletin 067; it is tagged as an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the vendor-assigned CVSS of 9.0 marks it as critical.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.