Authentication Bypass
Monthly
Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.
Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Missing authorization on the `/api/v1/delete/fwdhost` endpoint in mailcow-dockerized allows any low-privileged authenticated user to delete Forwarding Hosts, disrupting outbound mail routing and overall service availability. All versions prior to 2026-03b are affected; the flaw is rooted in inconsistent access control - add/edit operations are gated to administrators but the delete pathway is not. EPSS is low (0.04%) and the vulnerability is not in CISA KEV, though SSVC data indicates POC code exists, lowering the exploitation barrier for users with valid credentials.
Authentication bypass in mitmproxy 12.2.1 and below allows remote attackers to bypass LDAP-based proxy authentication through unsanitized username injection. The vulnerability affects only instances explicitly configured with the proxyauth option using LDAP authentication, which is disabled by default. Attackers can exploit this over the network without authentication or user interaction to gain unauthorized access to proxied connections.
FreeScout versions prior to 1.8.214 allow authenticated agents in shared mailboxes to recall another agent's reply within a 15-second undo window due to insufficient authorization checks on the undo-send endpoint. The vulnerability requires agent-level authentication and shared mailbox access but enables one user to suppress a colleague's outbound communication, affecting message integrity and audit trails in multi-agent help desk environments.
FreeScout prior to version 1.8.214 permits authenticated users to modify hidden customer profiles through email-based object reuse in the customer creation endpoint. By supplying an email address already associated with a hidden customer via POST /customers/ajax?action=create, an attacker can bypass unique-email validation and populate that customer's empty profile fields with arbitrary data, enabling account takeover or data manipulation without administrative privileges.
FreeScout versions prior to 1.8.213 expose complete customer PII through an authentication bypass in the `load_customer_info` action of POST /conversation/ajax, allowing any authenticated user to retrieve sensitive profile data for arbitrary customers by providing only a valid email address. The vulnerability affects the authorization layer rather than authentication, enabling lateral access to customer records across mailboxes without proper access control verification.
October CMS versions prior to 3.7.16 and 4.1.16 fail to enforce fine-grained sub-permission checks for asset and blueprint file operations in the CMS and Tailor editor extensions, allowing backend users with editor access but explicitly withheld editor.cms_assets or editor.tailor_blueprints permissions to perform unauthorized file operations (create, delete, rename, move, upload) on theme assets and blueprint files. Additionally, an operator precedence error discloses the theme blueprint directory tree under the same conditions. This affects an uncommon permission configuration where high-privileged users have granular restrictions selectively applied.
NVIDIA KAI Scheduler contains an improper authorization vulnerability allowing authenticated attackers to reference pods across Kubernetes namespaces they do not own, enabling data tampering. The vulnerability requires valid credentials and network access to the scheduler but does not permit confidentiality breaches or denial of service. CVSS 4.3 (low) reflects authenticated access requirement and integrity impact only; no active exploitation or public POC identified.
October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated backend users with Editor permissions to read arbitrary server files by crafting malicious CSS preprocessor files (.less, .sass, .scss) that exploit the compiler's import functionality. The vulnerability persists even when cms.safe_mode is enabled, enabling high-confidence information disclosure of sensitive configuration files, credentials, and application source code without requiring administrative privileges.
Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.
HTTP request smuggling in HCL BigFix Service Management allows remote unauthenticated attackers to exploit HTTP parsing inconsistencies between front-end and back-end servers, potentially leading to limited information disclosure through cache poisoning or request hijacking attacks. The vulnerability has a CVSS score of 3.7 with low confidentiality impact but no direct availability or integrity impact.
Mitigation bypass in Firefox's DOM Security component allows authenticated remote attackers with user interaction to circumvent security controls and gain limited read/write access to sensitive data across security boundaries. Firefox 150 and later versions contain the fix; versions prior to 150 are vulnerable. SSVC assessment indicates no current public exploitation, though the vulnerability requires user interaction and authentication to trigger.
Mitigation bypass in Mozilla Firefox's File Handling component allows remote network-reachable attackers to circumvent a security protection mechanism (CWE-693), resulting in partial confidentiality and integrity compromise. All Firefox stable versions prior to 150 and Firefox ESR versions prior to 140.10 are affected across platforms, with downstream impact confirmed for Red Hat Enterprise Linux and SUSE Linux packaging. No active exploitation has been confirmed - CISA KEV listing is absent, EPSS sits at 0.04% (12th percentile), and SSVC classifies exploitation status as none - making this a medium-priority patching item rather than an emergency response trigger.
DOM spoofing in Firefox allows remote attackers to deceive users about webpage origin and integrity through rendering manipulation, requiring user interaction. Affects Firefox 149 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier. Fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. EPSS score of 0.02% indicates low exploitation probability despite CVSS 6.3 rating, suggesting practical exploitation constraints despite network accessibility.
Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress versions up to 2.2.1 allows authenticated contributors and higher to modify global site-wide plugin configuration, including custom CSS settings, block availability, layout defaults (content width, padding, gap), and auto-recovery behavior due to missing authorization checks. This capability escalation bypasses intended role-based access control, enabling lower-privileged users to degrade site functionality and inject CSS-based attacks. No public exploit code or active exploitation confirmed at time of analysis; CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact, but real-world risk depends on contributor population and site governance.
OpenClaw before version 2026.3.31 allows unauthenticated remote attackers to trigger resource-intensive audio transcription processing via Telegram without proper authorization, enabling denial-of-service through billing or infrastructure exhaustion. The vulnerability stems from insufficient allowlist enforcement that permits unauthorized group senders to initiate preflight transcription operations before authentication is validated, and no public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.
OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.
OpenClaw before version 2026.4.2 fails to enforce write-scope authorization on the POST /sessions/:sessionKey/kill endpoint, allowing authenticated users with read-only credentials to terminate arbitrary subagent sessions. The vulnerability requires valid API credentials with read scope but does NOT require write permissions, enabling privilege escalation within identity-bearing authentication modes. No public exploit code has been identified, and this is not listed as actively exploited by CISA; however, the low CVSS score of 5.3 reflects the requirement for prior authentication rather than the ease of exploitation once credentials are obtained.
Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.
XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.
Dify prior to version 1.13.1 allows any authenticated user to delete other users' chat histories via the DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> endpoint due to insufficient authorization checks. An authenticated attacker can target any conversation ID to perform unauthorized deletion, resulting in data loss for other users. This vulnerability requires valid Dify authentication but no special privileges, affecting all vulnerable versions via network access.
Session key derivation in HKUDS OpenHarness prior to PR #159 fails to verify sender identity in shared chat/thread scopes, allowing authenticated users to hijack other participants' sessions and disrupt their active tasks through collision attacks on the shared ohmo session key. The vulnerability requires prior authentication and network access but enables lateral privilege escalation within collaborative environments. No public exploit code has been identified, though the fix is available via upstream commit 3186851c.
Cryptographic algorithm downgrade in AWS Encryption SDK for Python's caching layer allows authenticated local attackers to bypass key commitment policy enforcement through a shared key cache, enabling decryption of single ciphertext to multiple different plaintexts. Affected versions include Python 2 up to 2.5.1, Python 3 up to 3.3.0, and Python 4 up to 4.0.4. AWS has released vendor patches (versions 3.3.1, 4.0.5, and later) to remediate the vulnerability, which requires local access and authenticated credentials but has no known public exploit.
Magento LTS prior to version 20.17.0 allows authenticated attackers to access private wishlist items from other users via an authorization bypass in the shared wishlist add-to-cart endpoint. The vulnerability permits an attacker with a valid sharing code for one wishlist to import items from a different victim's wishlist into their cart by manipulating the wishlist_item_id parameter, potentially exposing private custom option data and enabling cross-user file disclosure when file upload custom options are present. CVSS 5.3 (AV:N/AC:L/PR:L) indicates network-accessible exploitation requiring low privileges; patch version 20.17.0 resolves the issue.
Canonical Livepatch snap client prior to 10.15.0 allows local unprivileged users to obtain a root-level authentication token via an unauthenticated request to the livepatchd.sock Unix domain socket, enabling attackers to impersonate the victim and access Livepatch services on systems with an active Ubuntu Pro subscription.
Improper authentication in rowboatlabs rowboat (versions up to 0.1.67) allows remote unauthenticated attackers to bypass authentication by manipulating the X-Tools-JWE header in the tools_webhook component. The vulnerability enables unauthorized access with low confidentiality, integrity, and availability impact. A public exploit exists (CVSS E:P). The vendor did not respond to early disclosure attempts. EPSS data unavailable; not listed in CISA KEV, suggesting limited widespread exploitation despite public POC.
Improper authorization in usememos memos up to version 0.22.1 allows authenticated remote attackers to bypass access controls via manipulation of additionalStyle and additionalScript arguments in the UpdateInstanceSetting component, potentially leading to unauthorized information disclosure, modification, and service disruption. The vulnerability has publicly available exploit code and affects the memos_access_token function in src/App.tsx. The vendor did not respond to early disclosure efforts.
Fudo Enterprise versions 5.5.0 through 5.6.2 permit low-privileged users to access administrator-only API endpoints, exposing sensitive system logs and configuration data due to improper authorization controls. Authenticated attackers with minimal privileges can escalate access to protected resources without additional user interaction. The vulnerability has been patched in version 5.6.3.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to access or modify project data without proper authorization checks in the project controller endpoints (get_project, update_project, get_projects_organisation). The vulnerability has publicly available exploit code and affects the project management functionality with limited confidentiality and integrity impact. The vendor did not respond to early disclosure notification.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated attackers to manipulate the agent_id parameter in delete_agent, stop_schedule, and get_schedule_data endpoints, bypassing access controls to perform unauthorized operations on agents and schedules. The vulnerability is remotely exploitable by any authenticated user and publicly available exploit code exists; however, the vendor has not responded to early disclosure attempts.
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls in the Agent Execution Endpoint by manipulating the agent_execution_id parameter in get_agent_execution and update_agent_execution functions. An attacker with valid credentials can access or modify agent execution records they should not have permission to interact with. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.
DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in djangoblog/settings.py that can be exploited remotely to bypass authentication and gain unauthorized access. The vulnerability stems from sensitive USER/PASSWORD arguments being embedded in configuration files, allowing attackers with network access to retrieve database credentials. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Improper authorization in liangliangyy DjangoBlog versions up to 2.1.0.0 allows authenticated remote attackers to manipulate the oauthid parameter in the oauth/views.py form_valid function, bypassing access controls to perform unauthorized operations. The vulnerability has confirmed public exploit code available and affects all instances where OAuth functionality is enabled. This is a privilege escalation or horizontal access control bypass vulnerability accessible to any authenticated user.
Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows remote attackers to upload malicious files without credentials, potentially leading to device compromise or unauthorized firmware modification. The CVSS score of 5.3 reflects limited integrity impact in a network-accessible service with no authentication requirement, though the real-world risk depends on what actions an attacker can perform post-upload.
SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing remote attackers to modify device settings without credentials. The CVSS score of 5.3 reflects network-accessible integrity impact with no complexity barrier, though confidentiality and availability are not directly affected. No active exploitation has been confirmed in CISA KEV or public exploit repositories at the time of analysis.
Remote authentication bypass in TransformerOptimus SuperAGI budget endpoints (versions up to 0.0.14) allows authenticated users to manipulate budget settings without proper authorization checks, potentially enabling unauthorized modification of financial controls. The vulnerability affects the get_budget and update_budget functions in superagi/controllers/budget.py and has publicly available exploit code. The vendor did not respond to early disclosure attempts.
Missing authentication in serge-chat serge up to version 1.4TB allows unauthenticated remote attackers to manipulate the download_model and delete_model API endpoints, enabling unauthorized model file deletion and modification through the Model API Endpoint in api/src/serge/routers/model.py. The vulnerability is confirmed to have publicly available exploit code and represents a direct authentication bypass with integrity and availability impact. The vendor did not respond to early disclosure notification.
Buffalo Link Station version 1.85-0.01 allows privilege escalation through username and role enumeration via parameter manipulation at the /nasapi endpoint. Authenticated or guest-level users can identify valid usernames and their associated privilege roles by modifying request parameters, enabling targeted privilege escalation attacks. While CVSS indicates a network vector, actual exploitation requires prior authentication or guest access, limiting immediate exposure but creating a stepping stone for further attacks.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated users to modify arbitrary organizations by manipulating the organisation_id parameter in the Organisation Update Endpoint, causing integrity and availability impact. Remote exploitation requires valid credentials and is limited to authenticated users (CVSS PR:L), but publicly available exploit code exists and the vendor has not responded to disclosure.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to modify user accounts by manipulating the user_id parameter in the User Update Endpoint (superagi/controllers/user.py), enabling unauthorized data modification and availability impact. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Authorization bypass in TransformerOptimus SuperAGI API Key Management allows authenticated users to delete or edit arbitrary API keys beyond their own permissions, affecting versions up to 0.0.14. The vulnerability exists in the delete_api_key and edit_api_key endpoints and enables authenticated attackers to manipulate other users' credentials remotely with low complexity. Publicly available exploit code exists, and the vendor has not responded to early disclosure.
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers to retrieve, modify, or disrupt stored embeddings via the /vector_dbs endpoint. Missing authentication (CWE-306) in the get_vector_db_details function enables unauthorized manipulation of AI agent knowledge bases with CVSS 7.3. Publicly available exploit code exists (Proof-of-Concept published on GitHub Gist), but no active exploitation confirmed via CISA KEV. EPSS data not provided. Vendor unresponsive to early disclosure per VulDB report.
DjangoBlog up to version 2.1.0.0 contains an authentication bypass vulnerability in the blog/views.py Clean Endpoint that allows remote unauthenticated attackers to trigger cache purge or data manipulation operations. The vulnerability has a CVSS score of 6.5 (medium severity) with network-accessible attack vector and low complexity; publicly available exploit code exists, and the vendor has not responded to early disclosure.
Liangliangyy DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in the SECRET_KEY parameter within djangoblog/settings.py, allowing remote unauthenticated attackers to bypass authentication and encrypt/decrypt sensitive session data. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor did not respond to early disclosure notification. With a CVSS score of 5.6 and AC:H rating, practical exploitation requires moderate technical effort but affects confidentiality, integrity, and availability.
Missing authentication in DjangoBlog 2.1.0.0 and prior allows remote unauthenticated attackers to inject GPS tracking data via the owntracks/views.py logtracks endpoint. Publicly available exploit code exists (GitHub POC). CVSS 7.3 with full network attack vector (AV:N/AC:L/PR:N/UI:N). EPSS and KEV status not provided, but POC availability indicates medium-to-high exploitation risk for internet-facing DjangoBlog instances with OwnTracks integration enabled. Vendor non-responsive to disclosure.
Hard-coded credentials in osuuu LightPicture versions up to 1.2.2 allow unauthenticated remote attackers to bypass authentication via the /public/install/lp.sql file at the API upload endpoint. The vulnerability enables unauthorized access with confidentiality, integrity, and availability impacts. A public exploit exists (CVSS:3.1 E:P), significantly lowering the attack barrier. The vendor was notified but has not responded or issued patches.
Improper authorization in Collabora KodExplorer up to version 4.52 allows remote unauthenticated attackers to bypass authentication via manipulation of the fileUpload parameter in the /app/controller/share.class.php endpoint, potentially enabling unauthorized file access or modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the attack requires high complexity and is described as difficult to execute in practice, limiting real-world exploitation despite public disclosure and vendor non-responsiveness.
Kodcloud KodExplorer up to version 4.52 contains an authorization bypass vulnerability in the roleGroupAction function that allows authenticated remote attackers to manipulate the group_role parameter and gain unauthorized access to sensitive information and system modification capabilities. The vulnerability has a CVSS score of 6.3 with public exploit code available, and the vendor has not responded to early disclosure notifications, leaving deployed instances without official patching options.
Remote authorization bypass in KodCloud KodExplorer up to version 4.52 allows high-privileged authenticated attackers to manipulate the path argument in the initInstall function (/app/controller/systemMember.class.php), resulting in integrity compromise. The exploit code is publicly available, and the vendor has not responded to early disclosure notifications, leaving deployed instances vulnerable without official remediation guidance.
Improper authentication in kodcloud KodExplorer versions up to 4.52 allows unauthenticated remote attackers to bypass access controls via the fileGet endpoint. The vulnerability resides in the fileGet function within /app/controller/share.class.php, exploitable by manipulating the fileUrl parameter. With CVSS 7.3 and network attack vector requiring no privileges or user interaction, this enables unauthorized file access and potential data manipulation. EPSS score unavailable; no CISA KEV listing indicates no confirmed widespread exploitation. Vendor non-responsive to disclosure attempts.
Improper authorization in EMQ EMQX Enterprise 6.0-6.1.0 allows authenticated remote attackers to trigger a denial-of-service condition via unspecified manipulation of the Session Handling component. CVSS 4.3 with attack vector AV:N/AC:L/PR:L reflects network-exploitable impact limited to availability; publicly available exploit code exists but active exploitation has not been confirmed by CISA KEV. The vendor has not responded to early disclosure notification.
DNN (DotNetNuke) Platform versions 6.0.0 through 10.2.1 allow authenticated users to bypass authorization controls in the friends feature and force acceptance of friend requests on behalf of other users, resulting in unauthorized relationship modifications. The vulnerability requires valid user credentials (PR:L) and affects the integrity of user social graphs without exposing sensitive data. No public exploit code or active exploitation has been confirmed; vendors have released patched version 10.2.2.
Authentication bypass in Auth0 Next.js SDK versions 4.12.0 through 4.17.1 allows authenticated users with UI interaction to access sensitive endpoints through improper proxy cache lookups during concurrent nonce retry operations. The vulnerability specifically affects deployments using the proxy handler with DPoP (Demonstration of Proof-of-Possession) enabled, potentially exposing confidential user information via /me/* and /my-org/* endpoints. Vendor-released patch: version 4.18.0.
mcp-neo4j-cypher before version 0.6.0 allows authenticated users to bypass read-only mode enforcement via APOC CALL procedures, enabling unauthorized write operations and server-side request forgery against Neo4j databases. The vulnerability requires login credentials and attacker preparation (CVSS AT:P), limiting real-world risk to insider threats or compromised accounts with legitimate access to the MCP server.
Unauthenticated remote attackers can access debug configuration endpoints on Anviz CX2 Lite and CX7 devices without credentials, exposing SSH and RTTY status information that facilitates reconnaissance. The vulnerability exists in network-accessible endpoints that return sensitive debug data, affecting both device models across all firmware versions.
Anviz CX7 Firmware allows unauthenticated remote retrieval of the most recently captured test photo, exposing sensitive operational imagery without requiring authentication or user interaction. Network-accessible instances are at immediate risk of information disclosure; the vulnerability affects all versions of Anviz CX7 Firmware. No public exploit code or active KEV listing identified at time of analysis, but the trivial exploitation requirements (network access, no authentication, no complexity) combined with CISA ICS advisory issuance (ICSA-26-106-03) indicate material risk in operational technology environments.
Unauthenticated remote attackers can capture photos using the front-facing camera on Anviz CX7 devices via a direct POST request, exposing visual information about the physical deployment environment without authentication. The vulnerability affects all versions of Anviz CX7 Firmware and is tracked in CISA industrial control systems advisories, indicating deployment in operational technology environments. With a CVSS score of 5.3 (network-accessible, no authentication required, low complexity), this represents a confidentiality breach suitable for reconnaissance or social engineering in sensitive facilities.
Dell PowerProtect Data Domain DD OS versions 8.4 through 8.5 fail to enforce rate limiting on authentication attempts, allowing high-privileged remote attackers to conduct brute-force attacks against administrative credentials without account lockout or delays. This authentication bypass vulnerability enables unauthorized access to backup infrastructure systems that manage critical data protection workflows, with CVSS 6.2 reflecting the requirement for already-elevated privileges and high attack complexity.
Dell PowerProtect Data Domain DD OS versions 8.4-8.5 contain a session fixation vulnerability allowing high-privileged remote attackers to hijack authenticated sessions and gain unauthorized access without requiring user interaction. CVSS 6.2 reflects the high-complexity attack surface (AC:H) offset by elevated attacker privileges (PR:H) and direct confidentiality/integrity impact; no public exploit or active exploitation has been identified at time of analysis.
Dell PowerProtect Data Domain versions 8.4 through 8.5 contain an improper authentication vulnerability allowing high-privileged remote attackers to bypass authentication and gain unauthorized access to the system. CVSS 6.6 (high complexity, high privileges required) reflects the need for elevated attacker credentials but significant confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Dell PowerProtect Data Domain versions 8.4 through 8.5 contain an improper authentication vulnerability (CWE-287) allowing high-privileged remote attackers to bypass authentication controls and gain unauthorized access to protected systems. The vulnerability requires high privilege level and high attack complexity but enables confidentiality, integrity, and availability impact if successfully exploited. No active exploitation in CISA KEV confirmed at time of analysis.
Authenticated attackers with subscriber-level WordPress access can bypass capability checks in the Canto plugin (versions up to 3.1.1) via unprotected AJAX endpoints to arbitrarily modify or delete critical plugin options controlling cron scheduling and disable scheduled update tasks. The vulnerability requires a logged-in user but accepts any authenticated account regardless of intended permissions, allowing privilege escalation of low-level accounts to perform administrative functions without authorization. No active exploitation confirmed; patch status not yet identified.
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.
LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.
wpForo Forum plugin for WordPress allows authenticated Subscriber-level attackers to modify arbitrary forum posts via variable extraction abuse and weak nonce validation. Attackers exploit the `extract($args, EXTR_OVERWRITE)` function in the `edit()` method to bypass permission checks, enabling unauthorized modification of post titles, bodies, names, and emails across all forum visibility levels including private forums and admin/moderator posts. A hardcoded nonce shared across all forum templates allows any user viewing any forum page to obtain a valid nonce, making exploitation trivial for authenticated users.
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints, allowing authenticated Subscriber-level users to access sensitive analytics data, retrieve and modify privacy audit status, and dismiss administrative notices. The vulnerability stems from reliance on nonce verification alone without role-based access control, affecting all installations with the plugin active and at least one authenticated user account. No public exploit code or active exploitation has been confirmed at time of analysis.
OAuth token interception in Cryptomator 1.19.1 is enabled by a logic flaw in CheckHostTrustController.getAuthority() that re-opens the attack surface addressed by CVE-2026-32303. An attacker with write access to a cloud-synced vault.cryptomator file can craft a Hub configuration mixing HTTPS-on-port-80 and plaintext HTTP endpoints, causing the application to auto-trust the vault without prompting the user while routing the OAuth tokenEndpoint over unencrypted HTTP. A network-positioned attacker who intercepts that exchange gains the victim's OAuth token and can authenticate to the Cryptomator Hub API on their behalf. No public exploit identified at time of analysis (SSVC lists poc), and EPSS sits at the 1st percentile, indicating low widespread exploitation probability. Vendor-released patch available in version 1.19.2.
Broken ownership check in zrok's DELETE /api/v2/unaccess endpoint allows a low-privileged authenticated user to permanently delete admin-created global frontend records, taking down all public shares routed through that frontend on the affected instance. The flaw exists in controller/unaccess.go (unaccessHandler.Handle, line 56): when a frontend's environment_id is NULL - the marker for admin-created global frontends - the ownership guard short-circuits to false and skips authorization entirely. Exploitation requires prior knowledge of a global frontend token obtained out-of-band; no active exploitation is confirmed (not in CISA KEV), and EPSS is 0.04% at the 11th percentile, indicating low real-world exploitation probability at time of analysis.
Protected file access bypass in Silverstripe Assets Module allows unauthenticated remote visitors to read files that should be restricted by the CMS file permission system. When image variants are generated via template rendering - for example calling ScaleWidth() or Convert() - the DBFile::getURL() and DBFile::getSourceURL() methods incorrectly insert an access grant into the current HTTP session, nullifying the "protected" visibility setting for those files. Versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2 are affected; patches exist at 2.4.5 and 3.1.3. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03%, but SSVC flags the attack as automatable.
Unauthorized BIOS access on Dell Client Platform systems is possible via a weak password recovery mechanism exploitable by anyone with physical access to the device. Affecting over 60 distinct Dell product lines - including Dell Pro, Alienware, ChengMing, and Dell G-series models - the flaw allows a physically-present, unauthenticated attacker to bypass BIOS password protections, with a CVSS-noted scope change indicating that the compromise can extend beyond the firmware layer itself. No public exploit code or CISA KEV listing exists; EPSS stands at 0.01%, and SSVC confirms exploitation status as 'none,' making this a low-urgency but real-risk issue for environments where physical security cannot be guaranteed.
Payment status manipulation in the Fluent Forms WordPress plugin (versions up to and including 6.1.21) allows unauthenticated remote attackers to alter Stripe SCA payment submission statuses - for example, forcing a pending payment to 'failed' - by supplying an arbitrary submission_id to an unprotected AJAX endpoint. The vulnerability stems from missing authorization and ownership validation on a user-controlled parameter in the Stripe SCA confirmation flow. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.03%, though SSVC flags the attack as automatable, making bulk interference with payment workflows theoretically feasible at scale.
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
Authorization bypass in the OneSignal - Web Push Notifications plugin for WordPress allows authenticated attackers with subscriber-level access to delete OneSignal metadata on arbitrary posts they do not own. Affected versions span all releases up to and including 3.8.0. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.03% and SSVC exploitation status of 'none', real-world risk is currently low despite being network-reachable.
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are not revoked, allowing locked users to continue accessing protected resources until the tokens naturally expire. Affected versions prior to 5.2.0.35 are vulnerable. A vendor patch is available, but no active exploitation or public exploits are known at this time.
Unauthenticated attackers can modify post share count metadata in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX (PostX) plugin versions up to 5.0.5 due to a missing capability check in the ultp_shareCount_callback() function. This allows unauthorized modification of share_count post meta for any post including private and draft posts, affecting all WordPress installations running the vulnerable plugin. No public exploit code or active exploitation has been identified at the time of analysis.
Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.
Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Missing authorization on the `/api/v1/delete/fwdhost` endpoint in mailcow-dockerized allows any low-privileged authenticated user to delete Forwarding Hosts, disrupting outbound mail routing and overall service availability. All versions prior to 2026-03b are affected; the flaw is rooted in inconsistent access control - add/edit operations are gated to administrators but the delete pathway is not. EPSS is low (0.04%) and the vulnerability is not in CISA KEV, though SSVC data indicates POC code exists, lowering the exploitation barrier for users with valid credentials.
Authentication bypass in mitmproxy 12.2.1 and below allows remote attackers to bypass LDAP-based proxy authentication through unsanitized username injection. The vulnerability affects only instances explicitly configured with the proxyauth option using LDAP authentication, which is disabled by default. Attackers can exploit this over the network without authentication or user interaction to gain unauthorized access to proxied connections.
FreeScout versions prior to 1.8.214 allow authenticated agents in shared mailboxes to recall another agent's reply within a 15-second undo window due to insufficient authorization checks on the undo-send endpoint. The vulnerability requires agent-level authentication and shared mailbox access but enables one user to suppress a colleague's outbound communication, affecting message integrity and audit trails in multi-agent help desk environments.
FreeScout prior to version 1.8.214 permits authenticated users to modify hidden customer profiles through email-based object reuse in the customer creation endpoint. By supplying an email address already associated with a hidden customer via POST /customers/ajax?action=create, an attacker can bypass unique-email validation and populate that customer's empty profile fields with arbitrary data, enabling account takeover or data manipulation without administrative privileges.
FreeScout versions prior to 1.8.213 expose complete customer PII through an authentication bypass in the `load_customer_info` action of POST /conversation/ajax, allowing any authenticated user to retrieve sensitive profile data for arbitrary customers by providing only a valid email address. The vulnerability affects the authorization layer rather than authentication, enabling lateral access to customer records across mailboxes without proper access control verification.
October CMS versions prior to 3.7.16 and 4.1.16 fail to enforce fine-grained sub-permission checks for asset and blueprint file operations in the CMS and Tailor editor extensions, allowing backend users with editor access but explicitly withheld editor.cms_assets or editor.tailor_blueprints permissions to perform unauthorized file operations (create, delete, rename, move, upload) on theme assets and blueprint files. Additionally, an operator precedence error discloses the theme blueprint directory tree under the same conditions. This affects an uncommon permission configuration where high-privileged users have granular restrictions selectively applied.
NVIDIA KAI Scheduler contains an improper authorization vulnerability allowing authenticated attackers to reference pods across Kubernetes namespaces they do not own, enabling data tampering. The vulnerability requires valid credentials and network access to the scheduler but does not permit confidentiality breaches or denial of service. CVSS 4.3 (low) reflects authenticated access requirement and integrity impact only; no active exploitation or public POC identified.
October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated backend users with Editor permissions to read arbitrary server files by crafting malicious CSS preprocessor files (.less, .sass, .scss) that exploit the compiler's import functionality. The vulnerability persists even when cms.safe_mode is enabled, enabling high-confidence information disclosure of sensitive configuration files, credentials, and application source code without requiring administrative privileges.
Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.
HTTP request smuggling in HCL BigFix Service Management allows remote unauthenticated attackers to exploit HTTP parsing inconsistencies between front-end and back-end servers, potentially leading to limited information disclosure through cache poisoning or request hijacking attacks. The vulnerability has a CVSS score of 3.7 with low confidentiality impact but no direct availability or integrity impact.
Mitigation bypass in Firefox's DOM Security component allows authenticated remote attackers with user interaction to circumvent security controls and gain limited read/write access to sensitive data across security boundaries. Firefox 150 and later versions contain the fix; versions prior to 150 are vulnerable. SSVC assessment indicates no current public exploitation, though the vulnerability requires user interaction and authentication to trigger.
Mitigation bypass in Mozilla Firefox's File Handling component allows remote network-reachable attackers to circumvent a security protection mechanism (CWE-693), resulting in partial confidentiality and integrity compromise. All Firefox stable versions prior to 150 and Firefox ESR versions prior to 140.10 are affected across platforms, with downstream impact confirmed for Red Hat Enterprise Linux and SUSE Linux packaging. No active exploitation has been confirmed - CISA KEV listing is absent, EPSS sits at 0.04% (12th percentile), and SSVC classifies exploitation status as none - making this a medium-priority patching item rather than an emergency response trigger.
DOM spoofing in Firefox allows remote attackers to deceive users about webpage origin and integrity through rendering manipulation, requiring user interaction. Affects Firefox 149 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier. Fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. EPSS score of 0.02% indicates low exploitation probability despite CVSS 6.3 rating, suggesting practical exploitation constraints despite network accessibility.
Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress versions up to 2.2.1 allows authenticated contributors and higher to modify global site-wide plugin configuration, including custom CSS settings, block availability, layout defaults (content width, padding, gap), and auto-recovery behavior due to missing authorization checks. This capability escalation bypasses intended role-based access control, enabling lower-privileged users to degrade site functionality and inject CSS-based attacks. No public exploit code or active exploitation confirmed at time of analysis; CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact, but real-world risk depends on contributor population and site governance.
OpenClaw before version 2026.3.31 allows unauthenticated remote attackers to trigger resource-intensive audio transcription processing via Telegram without proper authorization, enabling denial-of-service through billing or infrastructure exhaustion. The vulnerability stems from insufficient allowlist enforcement that permits unauthorized group senders to initiate preflight transcription operations before authentication is validated, and no public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.
OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.
OpenClaw before version 2026.4.2 fails to enforce write-scope authorization on the POST /sessions/:sessionKey/kill endpoint, allowing authenticated users with read-only credentials to terminate arbitrary subagent sessions. The vulnerability requires valid API credentials with read scope but does NOT require write permissions, enabling privilege escalation within identity-bearing authentication modes. No public exploit code has been identified, and this is not listed as actively exploited by CISA; however, the low CVSS score of 5.3 reflects the requirement for prior authentication rather than the ease of exploitation once credentials are obtained.
Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.
XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.
Dify prior to version 1.13.1 allows any authenticated user to delete other users' chat histories via the DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> endpoint due to insufficient authorization checks. An authenticated attacker can target any conversation ID to perform unauthorized deletion, resulting in data loss for other users. This vulnerability requires valid Dify authentication but no special privileges, affecting all vulnerable versions via network access.
Session key derivation in HKUDS OpenHarness prior to PR #159 fails to verify sender identity in shared chat/thread scopes, allowing authenticated users to hijack other participants' sessions and disrupt their active tasks through collision attacks on the shared ohmo session key. The vulnerability requires prior authentication and network access but enables lateral privilege escalation within collaborative environments. No public exploit code has been identified, though the fix is available via upstream commit 3186851c.
Cryptographic algorithm downgrade in AWS Encryption SDK for Python's caching layer allows authenticated local attackers to bypass key commitment policy enforcement through a shared key cache, enabling decryption of single ciphertext to multiple different plaintexts. Affected versions include Python 2 up to 2.5.1, Python 3 up to 3.3.0, and Python 4 up to 4.0.4. AWS has released vendor patches (versions 3.3.1, 4.0.5, and later) to remediate the vulnerability, which requires local access and authenticated credentials but has no known public exploit.
Magento LTS prior to version 20.17.0 allows authenticated attackers to access private wishlist items from other users via an authorization bypass in the shared wishlist add-to-cart endpoint. The vulnerability permits an attacker with a valid sharing code for one wishlist to import items from a different victim's wishlist into their cart by manipulating the wishlist_item_id parameter, potentially exposing private custom option data and enabling cross-user file disclosure when file upload custom options are present. CVSS 5.3 (AV:N/AC:L/PR:L) indicates network-accessible exploitation requiring low privileges; patch version 20.17.0 resolves the issue.
Canonical Livepatch snap client prior to 10.15.0 allows local unprivileged users to obtain a root-level authentication token via an unauthenticated request to the livepatchd.sock Unix domain socket, enabling attackers to impersonate the victim and access Livepatch services on systems with an active Ubuntu Pro subscription.
Improper authentication in rowboatlabs rowboat (versions up to 0.1.67) allows remote unauthenticated attackers to bypass authentication by manipulating the X-Tools-JWE header in the tools_webhook component. The vulnerability enables unauthorized access with low confidentiality, integrity, and availability impact. A public exploit exists (CVSS E:P). The vendor did not respond to early disclosure attempts. EPSS data unavailable; not listed in CISA KEV, suggesting limited widespread exploitation despite public POC.
Improper authorization in usememos memos up to version 0.22.1 allows authenticated remote attackers to bypass access controls via manipulation of additionalStyle and additionalScript arguments in the UpdateInstanceSetting component, potentially leading to unauthorized information disclosure, modification, and service disruption. The vulnerability has publicly available exploit code and affects the memos_access_token function in src/App.tsx. The vendor did not respond to early disclosure efforts.
Fudo Enterprise versions 5.5.0 through 5.6.2 permit low-privileged users to access administrator-only API endpoints, exposing sensitive system logs and configuration data due to improper authorization controls. Authenticated attackers with minimal privileges can escalate access to protected resources without additional user interaction. The vulnerability has been patched in version 5.6.3.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to access or modify project data without proper authorization checks in the project controller endpoints (get_project, update_project, get_projects_organisation). The vulnerability has publicly available exploit code and affects the project management functionality with limited confidentiality and integrity impact. The vendor did not respond to early disclosure notification.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated attackers to manipulate the agent_id parameter in delete_agent, stop_schedule, and get_schedule_data endpoints, bypassing access controls to perform unauthorized operations on agents and schedules. The vulnerability is remotely exploitable by any authenticated user and publicly available exploit code exists; however, the vendor has not responded to early disclosure attempts.
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls in the Agent Execution Endpoint by manipulating the agent_execution_id parameter in get_agent_execution and update_agent_execution functions. An attacker with valid credentials can access or modify agent execution records they should not have permission to interact with. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.
DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in djangoblog/settings.py that can be exploited remotely to bypass authentication and gain unauthorized access. The vulnerability stems from sensitive USER/PASSWORD arguments being embedded in configuration files, allowing attackers with network access to retrieve database credentials. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Improper authorization in liangliangyy DjangoBlog versions up to 2.1.0.0 allows authenticated remote attackers to manipulate the oauthid parameter in the oauth/views.py form_valid function, bypassing access controls to perform unauthorized operations. The vulnerability has confirmed public exploit code available and affects all instances where OAuth functionality is enabled. This is a privilege escalation or horizontal access control bypass vulnerability accessible to any authenticated user.
Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows remote attackers to upload malicious files without credentials, potentially leading to device compromise or unauthorized firmware modification. The CVSS score of 5.3 reflects limited integrity impact in a network-accessible service with no authentication requirement, though the real-world risk depends on what actions an attacker can perform post-upload.
SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing remote attackers to modify device settings without credentials. The CVSS score of 5.3 reflects network-accessible integrity impact with no complexity barrier, though confidentiality and availability are not directly affected. No active exploitation has been confirmed in CISA KEV or public exploit repositories at the time of analysis.
Remote authentication bypass in TransformerOptimus SuperAGI budget endpoints (versions up to 0.0.14) allows authenticated users to manipulate budget settings without proper authorization checks, potentially enabling unauthorized modification of financial controls. The vulnerability affects the get_budget and update_budget functions in superagi/controllers/budget.py and has publicly available exploit code. The vendor did not respond to early disclosure attempts.
Missing authentication in serge-chat serge up to version 1.4TB allows unauthenticated remote attackers to manipulate the download_model and delete_model API endpoints, enabling unauthorized model file deletion and modification through the Model API Endpoint in api/src/serge/routers/model.py. The vulnerability is confirmed to have publicly available exploit code and represents a direct authentication bypass with integrity and availability impact. The vendor did not respond to early disclosure notification.
Buffalo Link Station version 1.85-0.01 allows privilege escalation through username and role enumeration via parameter manipulation at the /nasapi endpoint. Authenticated or guest-level users can identify valid usernames and their associated privilege roles by modifying request parameters, enabling targeted privilege escalation attacks. While CVSS indicates a network vector, actual exploitation requires prior authentication or guest access, limiting immediate exposure but creating a stepping stone for further attacks.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated users to modify arbitrary organizations by manipulating the organisation_id parameter in the Organisation Update Endpoint, causing integrity and availability impact. Remote exploitation requires valid credentials and is limited to authenticated users (CVSS PR:L), but publicly available exploit code exists and the vendor has not responded to disclosure.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to modify user accounts by manipulating the user_id parameter in the User Update Endpoint (superagi/controllers/user.py), enabling unauthorized data modification and availability impact. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Authorization bypass in TransformerOptimus SuperAGI API Key Management allows authenticated users to delete or edit arbitrary API keys beyond their own permissions, affecting versions up to 0.0.14. The vulnerability exists in the delete_api_key and edit_api_key endpoints and enables authenticated attackers to manipulate other users' credentials remotely with low complexity. Publicly available exploit code exists, and the vendor has not responded to early disclosure.
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers to retrieve, modify, or disrupt stored embeddings via the /vector_dbs endpoint. Missing authentication (CWE-306) in the get_vector_db_details function enables unauthorized manipulation of AI agent knowledge bases with CVSS 7.3. Publicly available exploit code exists (Proof-of-Concept published on GitHub Gist), but no active exploitation confirmed via CISA KEV. EPSS data not provided. Vendor unresponsive to early disclosure per VulDB report.
DjangoBlog up to version 2.1.0.0 contains an authentication bypass vulnerability in the blog/views.py Clean Endpoint that allows remote unauthenticated attackers to trigger cache purge or data manipulation operations. The vulnerability has a CVSS score of 6.5 (medium severity) with network-accessible attack vector and low complexity; publicly available exploit code exists, and the vendor has not responded to early disclosure.
Liangliangyy DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in the SECRET_KEY parameter within djangoblog/settings.py, allowing remote unauthenticated attackers to bypass authentication and encrypt/decrypt sensitive session data. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor did not respond to early disclosure notification. With a CVSS score of 5.6 and AC:H rating, practical exploitation requires moderate technical effort but affects confidentiality, integrity, and availability.
Missing authentication in DjangoBlog 2.1.0.0 and prior allows remote unauthenticated attackers to inject GPS tracking data via the owntracks/views.py logtracks endpoint. Publicly available exploit code exists (GitHub POC). CVSS 7.3 with full network attack vector (AV:N/AC:L/PR:N/UI:N). EPSS and KEV status not provided, but POC availability indicates medium-to-high exploitation risk for internet-facing DjangoBlog instances with OwnTracks integration enabled. Vendor non-responsive to disclosure.
Hard-coded credentials in osuuu LightPicture versions up to 1.2.2 allow unauthenticated remote attackers to bypass authentication via the /public/install/lp.sql file at the API upload endpoint. The vulnerability enables unauthorized access with confidentiality, integrity, and availability impacts. A public exploit exists (CVSS:3.1 E:P), significantly lowering the attack barrier. The vendor was notified but has not responded or issued patches.
Improper authorization in Collabora KodExplorer up to version 4.52 allows remote unauthenticated attackers to bypass authentication via manipulation of the fileUpload parameter in the /app/controller/share.class.php endpoint, potentially enabling unauthorized file access or modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the attack requires high complexity and is described as difficult to execute in practice, limiting real-world exploitation despite public disclosure and vendor non-responsiveness.
Kodcloud KodExplorer up to version 4.52 contains an authorization bypass vulnerability in the roleGroupAction function that allows authenticated remote attackers to manipulate the group_role parameter and gain unauthorized access to sensitive information and system modification capabilities. The vulnerability has a CVSS score of 6.3 with public exploit code available, and the vendor has not responded to early disclosure notifications, leaving deployed instances without official patching options.
Remote authorization bypass in KodCloud KodExplorer up to version 4.52 allows high-privileged authenticated attackers to manipulate the path argument in the initInstall function (/app/controller/systemMember.class.php), resulting in integrity compromise. The exploit code is publicly available, and the vendor has not responded to early disclosure notifications, leaving deployed instances vulnerable without official remediation guidance.
Improper authentication in kodcloud KodExplorer versions up to 4.52 allows unauthenticated remote attackers to bypass access controls via the fileGet endpoint. The vulnerability resides in the fileGet function within /app/controller/share.class.php, exploitable by manipulating the fileUrl parameter. With CVSS 7.3 and network attack vector requiring no privileges or user interaction, this enables unauthorized file access and potential data manipulation. EPSS score unavailable; no CISA KEV listing indicates no confirmed widespread exploitation. Vendor non-responsive to disclosure attempts.
Improper authorization in EMQ EMQX Enterprise 6.0-6.1.0 allows authenticated remote attackers to trigger a denial-of-service condition via unspecified manipulation of the Session Handling component. CVSS 4.3 with attack vector AV:N/AC:L/PR:L reflects network-exploitable impact limited to availability; publicly available exploit code exists but active exploitation has not been confirmed by CISA KEV. The vendor has not responded to early disclosure notification.
DNN (DotNetNuke) Platform versions 6.0.0 through 10.2.1 allow authenticated users to bypass authorization controls in the friends feature and force acceptance of friend requests on behalf of other users, resulting in unauthorized relationship modifications. The vulnerability requires valid user credentials (PR:L) and affects the integrity of user social graphs without exposing sensitive data. No public exploit code or active exploitation has been confirmed; vendors have released patched version 10.2.2.
Authentication bypass in Auth0 Next.js SDK versions 4.12.0 through 4.17.1 allows authenticated users with UI interaction to access sensitive endpoints through improper proxy cache lookups during concurrent nonce retry operations. The vulnerability specifically affects deployments using the proxy handler with DPoP (Demonstration of Proof-of-Possession) enabled, potentially exposing confidential user information via /me/* and /my-org/* endpoints. Vendor-released patch: version 4.18.0.
mcp-neo4j-cypher before version 0.6.0 allows authenticated users to bypass read-only mode enforcement via APOC CALL procedures, enabling unauthorized write operations and server-side request forgery against Neo4j databases. The vulnerability requires login credentials and attacker preparation (CVSS AT:P), limiting real-world risk to insider threats or compromised accounts with legitimate access to the MCP server.
Unauthenticated remote attackers can access debug configuration endpoints on Anviz CX2 Lite and CX7 devices without credentials, exposing SSH and RTTY status information that facilitates reconnaissance. The vulnerability exists in network-accessible endpoints that return sensitive debug data, affecting both device models across all firmware versions.
Anviz CX7 Firmware allows unauthenticated remote retrieval of the most recently captured test photo, exposing sensitive operational imagery without requiring authentication or user interaction. Network-accessible instances are at immediate risk of information disclosure; the vulnerability affects all versions of Anviz CX7 Firmware. No public exploit code or active KEV listing identified at time of analysis, but the trivial exploitation requirements (network access, no authentication, no complexity) combined with CISA ICS advisory issuance (ICSA-26-106-03) indicate material risk in operational technology environments.
Unauthenticated remote attackers can capture photos using the front-facing camera on Anviz CX7 devices via a direct POST request, exposing visual information about the physical deployment environment without authentication. The vulnerability affects all versions of Anviz CX7 Firmware and is tracked in CISA industrial control systems advisories, indicating deployment in operational technology environments. With a CVSS score of 5.3 (network-accessible, no authentication required, low complexity), this represents a confidentiality breach suitable for reconnaissance or social engineering in sensitive facilities.
Dell PowerProtect Data Domain DD OS versions 8.4 through 8.5 fail to enforce rate limiting on authentication attempts, allowing high-privileged remote attackers to conduct brute-force attacks against administrative credentials without account lockout or delays. This authentication bypass vulnerability enables unauthorized access to backup infrastructure systems that manage critical data protection workflows, with CVSS 6.2 reflecting the requirement for already-elevated privileges and high attack complexity.
Dell PowerProtect Data Domain DD OS versions 8.4-8.5 contain a session fixation vulnerability allowing high-privileged remote attackers to hijack authenticated sessions and gain unauthorized access without requiring user interaction. CVSS 6.2 reflects the high-complexity attack surface (AC:H) offset by elevated attacker privileges (PR:H) and direct confidentiality/integrity impact; no public exploit or active exploitation has been identified at time of analysis.
Dell PowerProtect Data Domain versions 8.4 through 8.5 contain an improper authentication vulnerability allowing high-privileged remote attackers to bypass authentication and gain unauthorized access to the system. CVSS 6.6 (high complexity, high privileges required) reflects the need for elevated attacker credentials but significant confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Dell PowerProtect Data Domain versions 8.4 through 8.5 contain an improper authentication vulnerability (CWE-287) allowing high-privileged remote attackers to bypass authentication controls and gain unauthorized access to protected systems. The vulnerability requires high privilege level and high attack complexity but enables confidentiality, integrity, and availability impact if successfully exploited. No active exploitation in CISA KEV confirmed at time of analysis.
Authenticated attackers with subscriber-level WordPress access can bypass capability checks in the Canto plugin (versions up to 3.1.1) via unprotected AJAX endpoints to arbitrarily modify or delete critical plugin options controlling cron scheduling and disable scheduled update tasks. The vulnerability requires a logged-in user but accepts any authenticated account regardless of intended permissions, allowing privilege escalation of low-level accounts to perform administrative functions without authorization. No active exploitation confirmed; patch status not yet identified.
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.
LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.
wpForo Forum plugin for WordPress allows authenticated Subscriber-level attackers to modify arbitrary forum posts via variable extraction abuse and weak nonce validation. Attackers exploit the `extract($args, EXTR_OVERWRITE)` function in the `edit()` method to bypass permission checks, enabling unauthorized modification of post titles, bodies, names, and emails across all forum visibility levels including private forums and admin/moderator posts. A hardcoded nonce shared across all forum templates allows any user viewing any forum page to obtain a valid nonce, making exploitation trivial for authenticated users.
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints, allowing authenticated Subscriber-level users to access sensitive analytics data, retrieve and modify privacy audit status, and dismiss administrative notices. The vulnerability stems from reliance on nonce verification alone without role-based access control, affecting all installations with the plugin active and at least one authenticated user account. No public exploit code or active exploitation has been confirmed at time of analysis.
OAuth token interception in Cryptomator 1.19.1 is enabled by a logic flaw in CheckHostTrustController.getAuthority() that re-opens the attack surface addressed by CVE-2026-32303. An attacker with write access to a cloud-synced vault.cryptomator file can craft a Hub configuration mixing HTTPS-on-port-80 and plaintext HTTP endpoints, causing the application to auto-trust the vault without prompting the user while routing the OAuth tokenEndpoint over unencrypted HTTP. A network-positioned attacker who intercepts that exchange gains the victim's OAuth token and can authenticate to the Cryptomator Hub API on their behalf. No public exploit identified at time of analysis (SSVC lists poc), and EPSS sits at the 1st percentile, indicating low widespread exploitation probability. Vendor-released patch available in version 1.19.2.
Broken ownership check in zrok's DELETE /api/v2/unaccess endpoint allows a low-privileged authenticated user to permanently delete admin-created global frontend records, taking down all public shares routed through that frontend on the affected instance. The flaw exists in controller/unaccess.go (unaccessHandler.Handle, line 56): when a frontend's environment_id is NULL - the marker for admin-created global frontends - the ownership guard short-circuits to false and skips authorization entirely. Exploitation requires prior knowledge of a global frontend token obtained out-of-band; no active exploitation is confirmed (not in CISA KEV), and EPSS is 0.04% at the 11th percentile, indicating low real-world exploitation probability at time of analysis.
Protected file access bypass in Silverstripe Assets Module allows unauthenticated remote visitors to read files that should be restricted by the CMS file permission system. When image variants are generated via template rendering - for example calling ScaleWidth() or Convert() - the DBFile::getURL() and DBFile::getSourceURL() methods incorrectly insert an access grant into the current HTTP session, nullifying the "protected" visibility setting for those files. Versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2 are affected; patches exist at 2.4.5 and 3.1.3. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03%, but SSVC flags the attack as automatable.
Unauthorized BIOS access on Dell Client Platform systems is possible via a weak password recovery mechanism exploitable by anyone with physical access to the device. Affecting over 60 distinct Dell product lines - including Dell Pro, Alienware, ChengMing, and Dell G-series models - the flaw allows a physically-present, unauthenticated attacker to bypass BIOS password protections, with a CVSS-noted scope change indicating that the compromise can extend beyond the firmware layer itself. No public exploit code or CISA KEV listing exists; EPSS stands at 0.01%, and SSVC confirms exploitation status as 'none,' making this a low-urgency but real-risk issue for environments where physical security cannot be guaranteed.
Payment status manipulation in the Fluent Forms WordPress plugin (versions up to and including 6.1.21) allows unauthenticated remote attackers to alter Stripe SCA payment submission statuses - for example, forcing a pending payment to 'failed' - by supplying an arbitrary submission_id to an unprotected AJAX endpoint. The vulnerability stems from missing authorization and ownership validation on a user-controlled parameter in the Stripe SCA confirmation flow. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.03%, though SSVC flags the attack as automatable, making bulk interference with payment workflows theoretically feasible at scale.
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
Authorization bypass in the OneSignal - Web Push Notifications plugin for WordPress allows authenticated attackers with subscriber-level access to delete OneSignal metadata on arbitrary posts they do not own. Affected versions span all releases up to and including 3.8.0. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.03% and SSVC exploitation status of 'none', real-world risk is currently low despite being network-reachable.
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are not revoked, allowing locked users to continue accessing protected resources until the tokens naturally expire. Affected versions prior to 5.2.0.35 are vulnerable. A vendor patch is available, but no active exploitation or public exploits are known at this time.
Unauthenticated attackers can modify post share count metadata in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX (PostX) plugin versions up to 5.0.5 due to a missing capability check in the ultp_shareCount_callback() function. This allows unauthorized modification of share_count post meta for any post including private and draft posts, affecting all WordPress installations running the vulnerable plugin. No public exploit code or active exploitation has been identified at the time of analysis.