Authentication Bypass
Monthly
Unauthenticated attackers can modify stored map latitude and longitude options in the Basic Google Maps Placemarks WordPress plugin through version 1.10.7 due to missing authorization checks on administrative functions. The vulnerability allows remote, unauthenticated modification of critical map configuration without requiring user interaction, affecting any WordPress site running the vulnerable plugin with default settings. No public exploit code or active exploitation has been identified at the time of analysis.
Riaxe Product Customizer plugin for WordPress versions up to 2.1.2 allows unauthenticated attackers to delete arbitrary user accounts via a REST API endpoint lacking permission checks. The POST /wp-json/InkXEProductDesignerLite/customer/delete_customer route accepts a list of user IDs and directly deletes them without authentication or authorization validation, enabling attackers to remove administrator accounts and cause complete site lockout. This is confirmed by Wordfence and affects all installations running the vulnerable plugin version.
TP-Link Archer C7 v5 and v5.8 routers use weak RSA-1024 encryption for admin password transmission during web login, allowing adjacent attackers with network traffic interception capability to perform cryptanalytic attacks (brute-force or key factorization) to recover plaintext credentials and gain unauthorized administrative access. EPSS score of P (Probable) and active POC availability indicate realistic exploitation risk in local network environments; however, exploitation requires both network adjacency and successful cryptanalysis of a 1024-bit RSA key, limiting attack scope to motivated adversaries on shared networks (e.g., compromised WiFi).
Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Authorization bypass in OAuth2 Proxy versions before 7.15.2 allows authenticated attackers to circumvent email domain restrictions by presenting an email claim containing multiple '@' symbols (e.g., attacker@evil.com@company.com). The flaw affects deployments that rely on email_domain enforcement with identity providers that do not strictly validate email syntax; no active exploitation or public exploit code is currently reported, and EPSS indicates low exploitation probability.
Cross-origin data leak in Google Chrome prior to 147.0.7727.101 through insufficient CORS enforcement when the renderer process is already compromised. An attacker who has first achieved code execution inside the renderer can bypass cross-origin restrictions to expose sensitive data from other origins via a crafted HTML page. No active exploitation or public proof-of-concept has been identified, and the EPSS probability is extremely low at 0.01%.
Cross-origin data leakage in Google Chrome prior to 147.0.7727.101 allows a remote attacker to leak sensitive password data from other origins via a crafted HTML page, but only after they have already compromised the renderer process via a separate exploit. The vulnerability requires user interaction (visiting a malicious page) and has high attack complexity, resulting in a CVSS 3.1 base score of 3.1 (Low severity). No public exploit or active exploitation has been identified at time of analysis, and the EPSS probability is extremely low (0.01%).
Authorization bypass in KubeVirt's RBAC evaluation logic allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing restricted actions. Additionally, legitimate users may be denied resource access. Exploitation requires prior authentication and the presence of custom RBAC roles; no active exploitation or public exploit code is known at time of analysis.
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
Authentication policy bypass in Cisco Secure Web Appliance (AsyncOS) allows unauthenticated, remote attackers to send restricted HTTP requests through the appliance by exploiting improper validation of authentication input. The vulnerability (CWE-305) carries a CVSS 3.1 score of 5.3 and low EPSS likelihood (0.07%), with no active exploitation reported. Successful exploitation bypasses policy enforcement but does not directly compromise the appliance, resulting only in low integrity impact.
Local file overwrite in Cisco ThousandEyes Enterprise Agent allows authenticated, low-privileged CLI users to overwrite arbitrary files by placing a symbolic link in a specific directory, achieving integrity compromise on the agent host. This vulnerability (CVE-2026-20161) has low exploitation probability (EPSS 0.01%) and is not listed in CISA KEV; no public exploit code is currently known.
Improper access control in Splunk Enterprise
Information disclosure in Grafana Alerting allows users with the 'Contact Point Writer' role (part of Editor role) to extract redacted credentials from third-party integrations. By editing a contact point's endpoint URL to an attacker-controlled server and invoking the test function, redacted settings such as Slack tokens are sent to the attacker. Affected versions are Grafana Alerting 8.0.0 through 12.3.0; no public exploit or active exploitation identified, and the EPSS score is very low (0.04%).
Authenticated low-privilege users can modify settings in the MyRewards WordPress plugin through missing authorization checks, leading to limited integrity impact. Affected versions are up to 5.7.3. No active exploitation or public exploit code is known.
Information disclosure in Majestic Support versions 1.1.2 and below allows unauthenticated remote attackers to bypass authorization checks and view restricted data. The missing authorization flaw (CWE-862) has a CVSS 5.3 base score, with low confidentiality impact and no privilege escalation or system compromise. No active exploitation or public proof-of-concept is known, and EPSS predicts only a 0.02% chance of exploitation in the wild.
Missing authorization check in Royal Elementor Addons WordPress plugin allows unauthenticated attackers to modify data with low integrity impact. Affects versions up to 1.7.1056. No active exploitation has been reported, and the EPSS score of 0.02% indicates a very low probability of exploitation.
Sensitive data exposure in Nelio AB Testing WordPress plugin allows unauthenticated attackers to access restricted A/B test configurations and results. Affecting versions up to and including 8.2.8, this missing authorization vulnerability (CWE-862) can be exploited remotely without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.02%), reducing immediate risk.
Unauthorized modification of data in Tutor LMS 3.9.7 and earlier allows authenticated attackers with low privileges to exploit missing authorization checks, potentially altering course content or causing limited service disruption. The vulnerability carries a CVSS score of 5.4 but an EPSS score of 0.02% with no known active exploitation or public proof-of
Unauthorized data access in VillaTheme COMPE WordPress plugin versions ≤1.1.4 allows remote attackers to retrieve sensitive information by manipulating user-controlled keys. The vulnerability (CWE-639) is trivially exploitable over the network with no authentication, but impact is limited to confidential data exposure. No active exploitation or public exploit is currently known.
Information disclosure via missing authorization in ThemeGrill Demo Importer allows unauthenticated remote attackers to access sensitive demo import data. The vulnerability affects all plugin versions up to 2.0.0.6 and requires no user interaction. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content. Affected versions up to and including 1.8.5. No public exploitation has been identified, EPSS score is very low (0.02%), and SSVC indicates no exploitation, so real-world risk is minimal.
An authorization bypass in BlockArt Magazine Blocks for WordPress (≤1.8.3) lets authenticated users with lower privileges perform unauthorized data modifications. The vulnerability is not known to be actively exploited, and exploitation probability is assessed as low (EPSS 0.02%). The issue stems from missing capability checks that allow modified data access without proper permission verification.
Mattermost versions 10.11.0 through 10.11.12 fail to validate workspace ownership during Connected Workspaces API interactions, allowing a malicious remote server with high privileges to modify the displayed status of local users. This affects organizations using the Connected Workspaces federation feature and requires an attacker to already possess high administrative privileges on a connected remote instance. The vulnerability has CVSS 2.7 (low severity) and no public exploit code or active exploitation has been identified.
Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.
Authenticated users with Subscriber-level access or above can modify WordPress form field configurations in the e-shot form builder plugin (versions up to 1.0.2) due to missing authorization checks in the eshot_form_builder_update_field_data AJAX handler. The function lacks both capability checks and nonce verification, allowing attackers to manipulate form field properties such as mandatory status, visibility, and display preferences without proper permission validation. No public exploit code or active exploitation has been confirmed at this time.
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users to perform administrative actions, including modifying or deleting threat intelligence rules. With CVSS 8.1 (High) driven by high integrity and availability impact, this access control bypass (CWE-863) enables low-privileged users to alter critical security configurations remotely. No public exploit identified at time of analysis, though EPSS data unavailable. Authentication requirements lower the barrier only slightly, as compromised low-privilege accounts are common in enterprise environments.
Unauthenticated information disclosure in WordPress 3D FlipBook plugin ≤1.16.17 allows remote attackers to retrieve metadata of draft, private, and password-protected flipbooks via the send_post_pages_json() function missing a capability check. EPSS predicts very low exploitation probability (0.03%), but publicly available exploit code exists, and the attack requires no authentication or user interaction (CVSS 5.3). No evidence of active exploitation (not in CISA KEV) and SSVC flags automatable partial technical impact with no current exploitation.
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above to access protected post metadata through the Dynamic Data feature's `post_custom_field` parameter due to insufficient validation of underscore-prefixed metadata keys. The `fusion_get_post_custom_field()` function fails to enforce metadata access controls, enabling disclosure of sensitive metadata that should be restricted. No public exploit code or active exploitation has been confirmed at the time of analysis.
Unauthenticated attackers can bypass field-level authorization in Advanced Custom Fields (ACF) plugin versions up to 6.7.0 via AJAX endpoints that process user-supplied filter parameters without proper privilege checks, enabling disclosure of draft, private, and restricted post/page content that should be hidden by field configuration. The vulnerability affects any WordPress site with ACF installed and frontend forms exposed, requiring only network access and no user interaction. CVSS 5.3 reflects confidentiality impact with low attack complexity; no KEV status or public POC confirmed at analysis time.
Chamilo LMS versions prior to 2.0.0-RC.3 allow authenticated students to read private course notes of any other user via an Insecure Direct Object Reference (IDOR) vulnerability in the notebook module's editnote action. An attacker can manipulate the notebook_id parameter to bypass ownership checks in the read path (get_note_information()), exposing note titles and HTML body content despite write-path protections existing in updateNote() and delete_note(). The vulnerability requires valid student credentials but impacts confidentiality of sensitive educational materials across the platform.
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments belonging to other users within the same workspace via improper authorization checks on the POST /api/files/upload endpoint. An attacker can supply a victim's attachmentId to modify or corrupt files without user interaction, compromising document integrity across the workspace. No public exploit code has been identified; patch version 0.71.0 is available.
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restricted child page titles and text snippets via the public search endpoint, exposing confidential documentation content that should only be visible to authorized share viewers. This medium-severity confidentiality breach affects any Docmost instance with publicly shared workspaces and requires user interaction (clicking a link or accessing the search interface), but poses significant risk to organizations treating Docmost as a confidential knowledge base.
Unauthenticated attackers can bypass authorization checks in the Nexi XPay plugin for WordPress (versions up to 8.3.0) to mark pending WooCommerce orders as paid or completed by exploiting a missing authorization check on the redirect function. This allows payment fraud by converting unpaid orders into completed transactions without authentication. No public exploit code or active exploitation has been reported at time of analysis.
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Improper access control in Microsoft Dynamics 365 (on-premises) version 9.0 allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability stems from insufficient authorization checks that permit users with low-level privileges to access confidential data through local access vectors. This affects Dynamics 365 on-premises deployments up to version 9.0.0043.x, with vendor-released patches available from Microsoft.
Windows Biometric Service contains a race condition in concurrent resource access that allows unauthorized attackers to bypass biometric authentication controls via physical attack, affecting Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2019, 2022, and 2025. The vulnerability requires physical access to the device and carries a moderate CVSS score of 6.1 (physical attack vector); Microsoft has released patches for all affected versions.
Improper authentication in Windows Active Directory enables local spoofing attacks on unauthenticated users, allowing attackers with local access to bypass authentication mechanisms and gain unauthorized access to sensitive information. This vulnerability affects multiple Windows 10 and Windows 11 versions as well as Windows Server 2016 through 2025. A vendor-released patch is available from Microsoft, and the moderate CVSS score (6.2) reflects the local attack vector requirement combined with high confidentiality impact.
Denial of service in Microsoft .NET Framework 3.5 and 4.7.2-4.8.1 via race condition in shared resource synchronization allows unauthenticated remote attackers to crash affected applications with high complexity attack requirements. Microsoft has released patches addressing improper concurrent access handling across multiple .NET Framework versions.
Windows Virtualization-Based Security (VBS) Enclave in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 allows high-privileged local attackers to bypass security features through improper access control, resulting in integrity compromise without requiring user interaction. A vendor-released patch is available from Microsoft's security updates.
Windows Boot Loader accepts untrusted inputs for security decisions, allowing authorized local attackers to bypass security features with high confidentiality, integrity, and availability impact. This authentication bypass vulnerability (CVSS 6.7) affects Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2016, 2019, and 2022. Microsoft has released patches addressing the root cause of reliance on untrusted security-critical inputs.
Windows Hello biometric authentication can be bypassed by high-privileged local attackers through improper input validation, allowing unauthorized access to authentication mechanisms. This affects Windows 10 versions 21H2 and 22H2, and Windows 11 versions 22H3 through 26H1. The vulnerability requires administrative or SYSTEM-level privileges to exploit and does not enable remote exploitation, but represents a significant risk in multi-user or compromised-admin scenarios where biometric security is the primary defense mechanism.
Windows Boot Manager contains an uninitialized resource vulnerability (CWE-908) that allows unauthorized attackers to bypass security features through physical access to affected systems. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025. While the CVSS score of 4.6 reflects the physical attack vector requirement and information disclosure impact, the authentication bypass nature comb
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows authorized local attackers to bypass security features, affecting Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016-2025. With a CVSS score of 5.7 and high privilege requirement (PR:H), the vulnerability requires administrative or high-privilege account access but presents significant confidentiality and integrity risk to isolated security domai
Sandbox bypass in October CMS versions prior to 3.7.13 and 4.0.0-4.1.4 allows authenticated users with template editing permissions to bypass the optional Twig safe mode (CMS_SAFE_MODE) protections via unrestricted collect() helper methods. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with the non-default CMS_SAFE_MODE feature enabled. Fixed in versions 3.7.13 and 4.1.5.
Fortinet FortiOS allows unauthenticated remote attackers to execute arbitrary code or commands on affected devices through specially crafted packets due to missing authentication controls on a critical function. This affects FortiOS versions 6.2.9 through 6.2.17, all 6.4.x versions, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. With a CVSS score of 6.5 and an adjacent network attack vector, this represents a significant risk to FortiGate appliances accessible from local network segments. No public exploit code or active exploitation has been confirmed at time of analysis.
Schneider Electric Easergy MiCOM protective relays contain hard-coded SNMP credentials that allow unauthenticated remote attackers to access sensitive device information and system configurations. An attacker can directly query the SNMP port (UDP 161) without authentication to retrieve operational data, relay status, and device parameters. This vulnerability affects 12 product lines across multiple versions and is classified as an authentication bypass with a CVSS 6.9 (medium-to-high confidentiality impact).
Kiuwan SAST fails to properly enforce SSO login authorization for locally disabled user accounts, permitting disabled users to maintain application access through single sign-on mechanisms. This affects Kiuwan Cloud and Kiuwan SAST on-premise (KOP) versions prior to 2.8.2509.4, enabling authenticated attackers with prior credentials to bypass account disablement controls. An attacker whose account has been disabled by administrators can re-authenticate via SSO and regain unauthorized access to the system.
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perform actions with the privileges of other users. The vulnerability stems from missing authentication middleware on certain endpoints, enabling attackers on the local network (AV:A) to impersonate legitimate users without requiring credentials. No public exploit code or active exploitation has been confirmed at this time.
Authentication bypass in Siemens SINEC NMS versions prior to V4.0 SP3 with UMC allows unauthenticated remote attackers to gain unauthorized access due to insufficient user identity validation in the UMC component (CWE-347: Improper Verification of Cryptographic Signature). The vulnerability enables network-based attacks with low complexity requiring no user interaction (CVSS 7.3, AV:N/AC:L/PR:N/UI:N), granting partial access to confidentiality, integrity, and availability. ZDI tracking ID CAN-27564 suggests coordinated disclosure. No active exploitation (CISA KEV) or public exploit code confirmed at time of analysis, though JWT-related authentication bypasses are well-understood attack primitives.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
MaxKB versions 2.7.1 and below allow authenticated users to spoof tool execution results by exploiting Python frame introspection to extract the wrapper's UUID from bytecode, then writing forged output directly to file descriptor 1 to bypass stdout redirection and terminate the wrapper process before legitimate output is generated, causing the service to trust the attacker-controlled response. This integrity bypass requires prior authentication and local/network access but enables attackers to manipulate AI tool results without detection. The vulnerability has been patched in version 2.8.0.
Authorization bypass in sigstore/timestamp-authority verifier allows attackers to prepend forged certificates to PKCS#7 certificate bags, causing the library to validate signatures with one certificate while performing authorization checks on another. The vulnerability affects the `VerifyTimestampResponse` function in timestamp-authority/v2/pkg/verification, enabling attackers to bypass authorization controls on timestamp verification. This impacts only library consumers, not the timestamp-authority service itself, and sigstore-go is unaffected due to its use of the `TSACertificate` mitigation option. EPSS 5.5, actively exploitable via local interaction.
Input validation bypass in jq command-line JSON processor allows attackers to craft JSON with embedded NUL bytes that jq incorrectly truncates, validating only a benign prefix while silently discarding malicious trailing data. Versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are affected; the vulnerability enables parser differential attacks where jq validates hostile input as safe JSON, but downstream consumers process the complete input including injected payloads. With low CVSS (2.9) and attack timing complexity, exploitation risk remains moderate in scenarios where jq serves as a validation gate for untrusted JSON forwarded to other processors.
SAP S/4HANA frontend OData Service (Manage Reference Structures) allows authenticated users to update and delete child entities without proper authorization checks, enabling privilege escalation and data integrity violations. The vulnerability requires valid user credentials but no special privileges, affecting systems running vulnerable S/4HANA versions. Attackers can exploit exposed OData endpoints to modify or remove reference structure data that should be protected from their access level.
SAP S/4HANA backend OData Service for Manage Reference Structures allows authenticated remote attackers to modify and delete child entities without proper authorization checks, compromising data integrity across reference data structures. The vulnerability requires valid user credentials but no elevated privileges, affecting organizations running vulnerable S/4HANA versions. CVSS 6.5 with confirmed patch availability via SAP Security Patch Day.
SAP S/4HANA OData Service for Manage Reference Equipment lacks authorization checks, allowing authenticated users to modify and delete child entities without proper access controls. The vulnerability affects S/4HANA instances with the vulnerable OData service and requires low-privilege network access, resulting in high integrity impact but no confidentiality or availability risk. No public exploit code or active exploitation has been confirmed.
SAP S/4HANA OData Service for Manage Technical Object Structures allows authenticated users to update and delete child entities without proper authorization checks, enabling unauthorized data modification. The vulnerability affects S/4HANA deployments exposing the vulnerable OData service and requires valid user credentials but no elevated privileges. CVSS base score is 4.3 (low-to-medium severity) with confirmed patch availability from SAP Security Patch Day.
SAP S/4HANA (Private Cloud and On-Premise) allows authenticated local network users to delete arbitrary operating system files due to missing authorization checks, degrading system integrity and availability. The vulnerability requires prior authentication and high complexity attack conditions (AC:H), resulting in a CVSS score of 4.9. No evidence of active exploitation or public proof-of-concept code has been identified, but the authorization bypass is confirmed across both deployment models.
Material Master application fails to enforce authorization checks for authenticated users executing reports, allowing disclosure of sensitive information to any authenticated user regardless of intended access permissions. Affects SAP Material Master with CVSS 4.3 (low severity) and confirmed authentication requirement; no active exploitation reported. Remote attackers with valid credentials can access restricted report data without additional attack complexity.
Insecure session management in SAP Business Objects Business Intelligence Platform allows unauthenticated attackers to obtain and reuse valid session tokens, enabling unauthorized access to victim sessions with moderate complexity. An attacker exploiting this vulnerability could access or modify information within the compromised session's scope, affecting confidentiality and integrity. The attack requires user interaction (UI:R) and high attack complexity (AC:H), limiting real-world exploitation but still warranting prioritized remediation for organizations running affected BI Platform versions.
Missing authorization checks in SAP Business Analytics and SAP Content Management allow authenticated users to invoke unauthorized remote function module calls, enabling confidential data access beyond their assigned permissions. The vulnerability affects all versions of the product and carries a CVSS score of 6.5 with confirmed high confidentiality impact. No public exploit code or active exploitation has been reported at time of analysis.
Improper authorization in Snipe-IT v8.4.0 allows authenticated attackers holding the users.edit permission to overwrite sensitive authentication and account-state fields on arbitrary non-admin user accounts via a crafted PUT request to /api/v1/users/{id}. A publicly available proof-of-concept exists (SSVC: poc), enabling low-complexity account manipulation or effective takeover of regular user accounts without requiring admin privileges. The vulnerability is not confirmed in CISA KEV, and with an EPSS of 0.03% (8th percentile) widespread automated exploitation appears unlikely at this time, though the POC lowers the barrier to targeted misuse.
Insecure Direct Object Reference in EspoCRM 9.3.3 and earlier allows any authenticated user holding Email:create and Import permissions to read arbitrary attachment records owned by other users via the POST /api/v1/Email/importEml endpoint. The attacker supplies a victim's fileId, which the endpoint accepted without ACL validation and passed directly to the import service - importing the victim's .eml contents into the attacker's mailbox while simultaneously deleting the original victim attachment record as a side effect. A public proof-of-concept is available via the vendor's GitHub security advisory; EPSS remains at 0.02% (5th percentile), consistent with SSVC's 'Automatable: no' designation and no confirmed active exploitation at time of analysis.
Unauthenticated asset disclosure in Note Mark exposes full binary contents of private note attachments to any party who possesses both the note UUID and asset UUID. The GET route at `/api/notes/{noteID}/assets/{assetID}` was registered without authentication middleware in `handlers/assets.go`, and the backend SQL query (`SELECT * FROM note_assets WHERE id = ? AND note_id = ?`) omits any JOIN against `notes` or `books`, meaning book ownership and visibility are never verified. No active exploitation is confirmed in CISA KEV, but a proof-of-concept exists per SSVC assessment, and the fix is available in v0.19.2.
Improper access control in CodeAstro Online Job Portal 1.0 enables any authenticated user to delete job postings owned by other users by manipulating the `ID` parameter in requests to `/jobs/job-delete.php`. A proof-of-concept exploit is publicly available on GitHub. Despite the network-accessible attack vector, real-world risk is constrained by the authentication requirement, the low EPSS score (0.04%, 11th percentile), and the niche deployment footprint of this PHP application - no CISA KEV listing and no active exploitation signals have been observed.
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation, allowing malformed or invalid UTF-8 sequences in BSON data to bypass validation checks. This affects MongoDB C Driver versions prior to 1.30.5, 2.0.0, and 2.0.1, and impacts applications that depend on this validation function to process untrusted BSON data. Authenticated remote attackers can exploit this to inject invalid BSON data, potentially causing integrity issues in downstream processing; EPSS 0.48 indicates this is a moderate-priority issue that warrants patching but is not among the highest-risk vulnerabilities.
Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to bypass Extend Unlock authentication due to incorrect privilege assignment, enabling unauthorized device access without requiring prior authentication. The vulnerability requires physical proximity and user interaction but grants full confidentiality and integrity compromise of the device. No public exploit code has been identified at the time of analysis.
Samsung Mobile's Recents application prior to SMR Apr-2026 Release 1 fails to properly validate exceptional conditions, allowing a physical attacker to bypass App Pinning security controls. The vulnerability requires physical device access and has a CVSS score of 4.1 reflecting the physical attack vector and confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Device Care in Samsung Mobile devices prior to the April 2026 SMR Release 1 contains an improper exception handling vulnerability that permits physical attackers to bypass Knox Guard authentication enforcement. With a CVSS score of 4.4 and attack vector requiring physical access, this vulnerability poses a localized but serious integrity and confidentiality risk to device security architecture, particularly for devices left unattended or in corporate environments where physical access controls may be compromised.
Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypass network restrictions without authentication. The vulnerability affects data handling related to network restriction policies, enabling unauthorized modification of network access controls. CVSS score of 5.2 reflects the physical attack requirement, though integrity and availability impacts are rated high for affected functions.
Improper access control in Huawei HarmonyOS memo module allows local, unauthenticated users to bypass authentication and read sensitive memo data, affecting confidentiality and system availability. The vulnerability requires user interaction (UI interaction flag set) and involves high attack complexity, resulting in a CVSS score of 4.1. No public exploit code or active exploitation has been confirmed at time of analysis.
Authentication bypass in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows remote unauthenticated attackers to manipulate the Agent Mode Service component, resulting in missing authentication checks (CWE-306). Publicly available exploit code exists, and the vulnerability has been reported to the project without response. CVSS 6.9 reflects moderate confidentiality, integrity, and availability impact with network-accessible attack vector and no user interaction required.
Missing authentication in zhayujie chatgpt-on-wechat CowAgent 2.0.4 administrative HTTP endpoint allows remote attackers to bypass access controls and perform unauthorized administrative operations without credentials. Publicly available exploit code exists. EPSS risk not available; CVSS 7.3 reflects network-based attack requiring no privileges or user interaction. The vendor has not responded to the vulnerability disclosure (GitHub issue #2733) at time of analysis.
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.
Net::CIDR::Lite before version 0.23 for Perl incorrectly handles RFC 4291 IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) by including an extra sentinel byte during packing, resulting in 18-byte instead of 17-byte representations. This misalignment causes the find() and bin_find() functions to return incorrect matching results during IP address lookup operations, enabling attackers to bypass IP-based access control lists by crafting addresses that fall outside intended CIDR ranges. No active exploitation has been identified, but the low EPSS score (0.02%) masks the authentication bypass tag, suggesting limited real-world triggering conditions despite the 6.5 CVSS score.
Microsoft Edge (Chromium-based) on Android contains a user interface misrepresentation vulnerability that allows unauthenticated remote attackers to conduct spoofing attacks over a network. The vulnerability exploits UI rendering to misrepresent critical information to end users, enabling attackers to deceive users into taking unintended actions. While the CVSS score is moderate (5.4), the attack requires user interaction and only impacts confidentiality and integrity; a vendor-released patch is available.
Temporal's frontend gRPC server fails to enforce authentication and authorization on the StreamWorkflowReplicationMessages endpoint, allowing unauthenticated network attackers to establish replication streams and potentially exfiltrate workflow data when replication targets are configured. The vulnerability affects Temporal versions prior to 1.28.4, 1.29.6, and 1.30.4; Temporal Cloud deployments are unaffected. While exploitation requires knowledge of cluster configuration and correctly configured replication targets, the authentication bypass on a network-accessible service combined with a moderate CVSS score (6.3) reflects the practical risk of unauthorized data access in multi-tenant or sensitive workflow environments.
Broken Access Control in FastGPT versions prior to 4.14.10.4 allows authenticated teams to access and execute applications belonging to other teams by supplying a foreign application ID, enabling cross-tenant data exposure and unauthorized workflow execution. The vulnerability stems from insufficient API validation-while team tokens are verified, the API fails to confirm that the requested application belongs to the authenticated team. This affects all FastGPT instances with multi-tenant deployments where different teams manage separate AI Agent applications, and is fixed in version 4.14.10.4.
ClearanceKit for macOS prior to version 5.0.4-beta-1f46165 fails to validate destination paths in dual-path file operations (rename, link, copyfile, exchangedata, clone), allowing authenticated local processes to bypass file-access protection and place or replace files in protected directories. The vulnerability affects all versions before 5.0.4-beta-1f46165 and has been patched; no public exploit code or active exploitation has been identified at the time of analysis.
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unauthenticated remote attackers to enumerate and access private photo collections through direct URL access. The vulnerability is restricted to information disclosure with low impact due to attack complexity constraints, though it exposes sensitive travel-related imagery that users expect to be private.
Remote authentication bypass in Ajenti prior to version 0.112 allows unauthenticated network attackers to circumvent two-factor authentication during a brief post-authentication window with high attack complexity. The vulnerability affects the core authentication mechanism in ajenti.plugin.core and permits attackers to gain high-confidence access to protected resources; the vendor released patched version 0.112 to resolve this issue.
Chamilo LMS versions prior to 2.0.0-RC.3 allow authenticated students and lower-privileged users to enumerate all platform users and extract sensitive personal information (email addresses, phone numbers, role assignments) through an unauthenticated API endpoint (GET /api/users), enabling reconnaissance of administrator accounts and organizational structure. The vulnerability affects any installation with user accounts below administrative level and is fixed in version 2.0.0-RC.3.
Chamilo LMS REST API endpoint get_user_info_from_username fails to authorize requests, exposing personal information (email, names, user ID, active status) to any authenticated user regardless of role prior to version 1.11.38. An attacker with valid login credentials, including a student account, can enumerate and retrieve sensitive user data for any account in the system.
Insecure Direct Object Reference in Chamilo LMS REST API stats endpoint allows authenticated low-privilege users to read unauthorized access to any user's learning progress, certificates, and gradebook scores across all courses prior to version 2.0.0-RC.3. The vulnerability requires only valid user credentials (accessible to students with ROLE_USER) and network access, enabling horizontal privilege escalation without administrative intervention or system compromise. No public exploit code or active exploitation has been identified at time of analysis.
OpenClaw before version 2026.3.22 allows authenticated attackers to redirect webhook-triggered chat replies to unintended users by exploiting username-based recipient binding instead of stable numeric identifiers. An attacker with valid credentials can manipulate username changes to rebind webhook replies intended for one user to a different user, compromising message confidentiality and integrity. No public exploit code or active CISA exploitation data is available, but the vulnerability is confirmed patched by the vendor.
OpenClaw before version 2026.3.25 contains an authentication bypass vulnerability in the raw card send surface that allows unauthenticated remote attackers to send malformed card commands, bypassing DM pairing restrictions and reaching callback handlers without proper authorization. This enables unpaired recipients to mint legacy callback payloads, resulting in integrity compromise of the messaging protocol. No public exploit code or active exploitation has been confirmed, but the low attack complexity and network accessibility make this a practical vulnerability.
OpenClaw before version 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing authenticated leaf subagents to bypass access control and message child sessions beyond their authorized scope. An authenticated attacker with subagent privileges can exploit this via the send action to communicate with restricted child sessions without proper validation, resulting in unauthorized inter-session message relay. No public exploit code has been identified, but the vulnerability has a moderate CVSS score of 4.3 reflecting the integrity impact and low attack complexity.
OpenClaw before 2026.3.25 allows remote attackers to bypass Telegram direct message pairing requirements and mutate session state through weaker callback-only authorization mechanisms. An unauthenticated attacker can craft malicious Telegram callback queries in direct messages to modify session state without satisfying the normal DM pairing security controls, resulting in unauthorized state modification with CVSS 5.3 (medium severity).
Unauthenticated attackers can modify stored map latitude and longitude options in the Basic Google Maps Placemarks WordPress plugin through version 1.10.7 due to missing authorization checks on administrative functions. The vulnerability allows remote, unauthenticated modification of critical map configuration without requiring user interaction, affecting any WordPress site running the vulnerable plugin with default settings. No public exploit code or active exploitation has been identified at the time of analysis.
Riaxe Product Customizer plugin for WordPress versions up to 2.1.2 allows unauthenticated attackers to delete arbitrary user accounts via a REST API endpoint lacking permission checks. The POST /wp-json/InkXEProductDesignerLite/customer/delete_customer route accepts a list of user IDs and directly deletes them without authentication or authorization validation, enabling attackers to remove administrator accounts and cause complete site lockout. This is confirmed by Wordfence and affects all installations running the vulnerable plugin version.
TP-Link Archer C7 v5 and v5.8 routers use weak RSA-1024 encryption for admin password transmission during web login, allowing adjacent attackers with network traffic interception capability to perform cryptanalytic attacks (brute-force or key factorization) to recover plaintext credentials and gain unauthorized administrative access. EPSS score of P (Probable) and active POC availability indicate realistic exploitation risk in local network environments; however, exploitation requires both network adjacency and successful cryptanalysis of a 1024-bit RSA key, limiting attack scope to motivated adversaries on shared networks (e.g., compromised WiFi).
Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Authorization bypass in OAuth2 Proxy versions before 7.15.2 allows authenticated attackers to circumvent email domain restrictions by presenting an email claim containing multiple '@' symbols (e.g., attacker@evil.com@company.com). The flaw affects deployments that rely on email_domain enforcement with identity providers that do not strictly validate email syntax; no active exploitation or public exploit code is currently reported, and EPSS indicates low exploitation probability.
Cross-origin data leak in Google Chrome prior to 147.0.7727.101 through insufficient CORS enforcement when the renderer process is already compromised. An attacker who has first achieved code execution inside the renderer can bypass cross-origin restrictions to expose sensitive data from other origins via a crafted HTML page. No active exploitation or public proof-of-concept has been identified, and the EPSS probability is extremely low at 0.01%.
Cross-origin data leakage in Google Chrome prior to 147.0.7727.101 allows a remote attacker to leak sensitive password data from other origins via a crafted HTML page, but only after they have already compromised the renderer process via a separate exploit. The vulnerability requires user interaction (visiting a malicious page) and has high attack complexity, resulting in a CVSS 3.1 base score of 3.1 (Low severity). No public exploit or active exploitation has been identified at time of analysis, and the EPSS probability is extremely low (0.01%).
Authorization bypass in KubeVirt's RBAC evaluation logic allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing restricted actions. Additionally, legitimate users may be denied resource access. Exploitation requires prior authentication and the presence of custom RBAC roles; no active exploitation or public exploit code is known at time of analysis.
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
Authentication policy bypass in Cisco Secure Web Appliance (AsyncOS) allows unauthenticated, remote attackers to send restricted HTTP requests through the appliance by exploiting improper validation of authentication input. The vulnerability (CWE-305) carries a CVSS 3.1 score of 5.3 and low EPSS likelihood (0.07%), with no active exploitation reported. Successful exploitation bypasses policy enforcement but does not directly compromise the appliance, resulting only in low integrity impact.
Local file overwrite in Cisco ThousandEyes Enterprise Agent allows authenticated, low-privileged CLI users to overwrite arbitrary files by placing a symbolic link in a specific directory, achieving integrity compromise on the agent host. This vulnerability (CVE-2026-20161) has low exploitation probability (EPSS 0.01%) and is not listed in CISA KEV; no public exploit code is currently known.
Improper access control in Splunk Enterprise
Information disclosure in Grafana Alerting allows users with the 'Contact Point Writer' role (part of Editor role) to extract redacted credentials from third-party integrations. By editing a contact point's endpoint URL to an attacker-controlled server and invoking the test function, redacted settings such as Slack tokens are sent to the attacker. Affected versions are Grafana Alerting 8.0.0 through 12.3.0; no public exploit or active exploitation identified, and the EPSS score is very low (0.04%).
Authenticated low-privilege users can modify settings in the MyRewards WordPress plugin through missing authorization checks, leading to limited integrity impact. Affected versions are up to 5.7.3. No active exploitation or public exploit code is known.
Information disclosure in Majestic Support versions 1.1.2 and below allows unauthenticated remote attackers to bypass authorization checks and view restricted data. The missing authorization flaw (CWE-862) has a CVSS 5.3 base score, with low confidentiality impact and no privilege escalation or system compromise. No active exploitation or public proof-of-concept is known, and EPSS predicts only a 0.02% chance of exploitation in the wild.
Missing authorization check in Royal Elementor Addons WordPress plugin allows unauthenticated attackers to modify data with low integrity impact. Affects versions up to 1.7.1056. No active exploitation has been reported, and the EPSS score of 0.02% indicates a very low probability of exploitation.
Sensitive data exposure in Nelio AB Testing WordPress plugin allows unauthenticated attackers to access restricted A/B test configurations and results. Affecting versions up to and including 8.2.8, this missing authorization vulnerability (CWE-862) can be exploited remotely without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.02%), reducing immediate risk.
Unauthorized modification of data in Tutor LMS 3.9.7 and earlier allows authenticated attackers with low privileges to exploit missing authorization checks, potentially altering course content or causing limited service disruption. The vulnerability carries a CVSS score of 5.4 but an EPSS score of 0.02% with no known active exploitation or public proof-of
Unauthorized data access in VillaTheme COMPE WordPress plugin versions ≤1.1.4 allows remote attackers to retrieve sensitive information by manipulating user-controlled keys. The vulnerability (CWE-639) is trivially exploitable over the network with no authentication, but impact is limited to confidential data exposure. No active exploitation or public exploit is currently known.
Information disclosure via missing authorization in ThemeGrill Demo Importer allows unauthenticated remote attackers to access sensitive demo import data. The vulnerability affects all plugin versions up to 2.0.0.6 and requires no user interaction. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content. Affected versions up to and including 1.8.5. No public exploitation has been identified, EPSS score is very low (0.02%), and SSVC indicates no exploitation, so real-world risk is minimal.
An authorization bypass in BlockArt Magazine Blocks for WordPress (≤1.8.3) lets authenticated users with lower privileges perform unauthorized data modifications. The vulnerability is not known to be actively exploited, and exploitation probability is assessed as low (EPSS 0.02%). The issue stems from missing capability checks that allow modified data access without proper permission verification.
Mattermost versions 10.11.0 through 10.11.12 fail to validate workspace ownership during Connected Workspaces API interactions, allowing a malicious remote server with high privileges to modify the displayed status of local users. This affects organizations using the Connected Workspaces federation feature and requires an attacker to already possess high administrative privileges on a connected remote instance. The vulnerability has CVSS 2.7 (low severity) and no public exploit code or active exploitation has been identified.
Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.
Authenticated users with Subscriber-level access or above can modify WordPress form field configurations in the e-shot form builder plugin (versions up to 1.0.2) due to missing authorization checks in the eshot_form_builder_update_field_data AJAX handler. The function lacks both capability checks and nonce verification, allowing attackers to manipulate form field properties such as mandatory status, visibility, and display preferences without proper permission validation. No public exploit code or active exploitation has been confirmed at this time.
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users to perform administrative actions, including modifying or deleting threat intelligence rules. With CVSS 8.1 (High) driven by high integrity and availability impact, this access control bypass (CWE-863) enables low-privileged users to alter critical security configurations remotely. No public exploit identified at time of analysis, though EPSS data unavailable. Authentication requirements lower the barrier only slightly, as compromised low-privilege accounts are common in enterprise environments.
Unauthenticated information disclosure in WordPress 3D FlipBook plugin ≤1.16.17 allows remote attackers to retrieve metadata of draft, private, and password-protected flipbooks via the send_post_pages_json() function missing a capability check. EPSS predicts very low exploitation probability (0.03%), but publicly available exploit code exists, and the attack requires no authentication or user interaction (CVSS 5.3). No evidence of active exploitation (not in CISA KEV) and SSVC flags automatable partial technical impact with no current exploitation.
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above to access protected post metadata through the Dynamic Data feature's `post_custom_field` parameter due to insufficient validation of underscore-prefixed metadata keys. The `fusion_get_post_custom_field()` function fails to enforce metadata access controls, enabling disclosure of sensitive metadata that should be restricted. No public exploit code or active exploitation has been confirmed at the time of analysis.
Unauthenticated attackers can bypass field-level authorization in Advanced Custom Fields (ACF) plugin versions up to 6.7.0 via AJAX endpoints that process user-supplied filter parameters without proper privilege checks, enabling disclosure of draft, private, and restricted post/page content that should be hidden by field configuration. The vulnerability affects any WordPress site with ACF installed and frontend forms exposed, requiring only network access and no user interaction. CVSS 5.3 reflects confidentiality impact with low attack complexity; no KEV status or public POC confirmed at analysis time.
Chamilo LMS versions prior to 2.0.0-RC.3 allow authenticated students to read private course notes of any other user via an Insecure Direct Object Reference (IDOR) vulnerability in the notebook module's editnote action. An attacker can manipulate the notebook_id parameter to bypass ownership checks in the read path (get_note_information()), exposing note titles and HTML body content despite write-path protections existing in updateNote() and delete_note(). The vulnerability requires valid student credentials but impacts confidentiality of sensitive educational materials across the platform.
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments belonging to other users within the same workspace via improper authorization checks on the POST /api/files/upload endpoint. An attacker can supply a victim's attachmentId to modify or corrupt files without user interaction, compromising document integrity across the workspace. No public exploit code has been identified; patch version 0.71.0 is available.
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restricted child page titles and text snippets via the public search endpoint, exposing confidential documentation content that should only be visible to authorized share viewers. This medium-severity confidentiality breach affects any Docmost instance with publicly shared workspaces and requires user interaction (clicking a link or accessing the search interface), but poses significant risk to organizations treating Docmost as a confidential knowledge base.
Unauthenticated attackers can bypass authorization checks in the Nexi XPay plugin for WordPress (versions up to 8.3.0) to mark pending WooCommerce orders as paid or completed by exploiting a missing authorization check on the redirect function. This allows payment fraud by converting unpaid orders into completed transactions without authentication. No public exploit code or active exploitation has been reported at time of analysis.
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Improper access control in Microsoft Dynamics 365 (on-premises) version 9.0 allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability stems from insufficient authorization checks that permit users with low-level privileges to access confidential data through local access vectors. This affects Dynamics 365 on-premises deployments up to version 9.0.0043.x, with vendor-released patches available from Microsoft.
Windows Biometric Service contains a race condition in concurrent resource access that allows unauthorized attackers to bypass biometric authentication controls via physical attack, affecting Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2019, 2022, and 2025. The vulnerability requires physical access to the device and carries a moderate CVSS score of 6.1 (physical attack vector); Microsoft has released patches for all affected versions.
Improper authentication in Windows Active Directory enables local spoofing attacks on unauthenticated users, allowing attackers with local access to bypass authentication mechanisms and gain unauthorized access to sensitive information. This vulnerability affects multiple Windows 10 and Windows 11 versions as well as Windows Server 2016 through 2025. A vendor-released patch is available from Microsoft, and the moderate CVSS score (6.2) reflects the local attack vector requirement combined with high confidentiality impact.
Denial of service in Microsoft .NET Framework 3.5 and 4.7.2-4.8.1 via race condition in shared resource synchronization allows unauthenticated remote attackers to crash affected applications with high complexity attack requirements. Microsoft has released patches addressing improper concurrent access handling across multiple .NET Framework versions.
Windows Virtualization-Based Security (VBS) Enclave in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 allows high-privileged local attackers to bypass security features through improper access control, resulting in integrity compromise without requiring user interaction. A vendor-released patch is available from Microsoft's security updates.
Windows Boot Loader accepts untrusted inputs for security decisions, allowing authorized local attackers to bypass security features with high confidentiality, integrity, and availability impact. This authentication bypass vulnerability (CVSS 6.7) affects Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2016, 2019, and 2022. Microsoft has released patches addressing the root cause of reliance on untrusted security-critical inputs.
Windows Hello biometric authentication can be bypassed by high-privileged local attackers through improper input validation, allowing unauthorized access to authentication mechanisms. This affects Windows 10 versions 21H2 and 22H2, and Windows 11 versions 22H3 through 26H1. The vulnerability requires administrative or SYSTEM-level privileges to exploit and does not enable remote exploitation, but represents a significant risk in multi-user or compromised-admin scenarios where biometric security is the primary defense mechanism.
Windows Boot Manager contains an uninitialized resource vulnerability (CWE-908) that allows unauthorized attackers to bypass security features through physical access to affected systems. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025. While the CVSS score of 4.6 reflects the physical attack vector requirement and information disclosure impact, the authentication bypass nature comb
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows authorized local attackers to bypass security features, affecting Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016-2025. With a CVSS score of 5.7 and high privilege requirement (PR:H), the vulnerability requires administrative or high-privilege account access but presents significant confidentiality and integrity risk to isolated security domai
Sandbox bypass in October CMS versions prior to 3.7.13 and 4.0.0-4.1.4 allows authenticated users with template editing permissions to bypass the optional Twig safe mode (CMS_SAFE_MODE) protections via unrestricted collect() helper methods. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with the non-default CMS_SAFE_MODE feature enabled. Fixed in versions 3.7.13 and 4.1.5.
Fortinet FortiOS allows unauthenticated remote attackers to execute arbitrary code or commands on affected devices through specially crafted packets due to missing authentication controls on a critical function. This affects FortiOS versions 6.2.9 through 6.2.17, all 6.4.x versions, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. With a CVSS score of 6.5 and an adjacent network attack vector, this represents a significant risk to FortiGate appliances accessible from local network segments. No public exploit code or active exploitation has been confirmed at time of analysis.
Schneider Electric Easergy MiCOM protective relays contain hard-coded SNMP credentials that allow unauthenticated remote attackers to access sensitive device information and system configurations. An attacker can directly query the SNMP port (UDP 161) without authentication to retrieve operational data, relay status, and device parameters. This vulnerability affects 12 product lines across multiple versions and is classified as an authentication bypass with a CVSS 6.9 (medium-to-high confidentiality impact).
Kiuwan SAST fails to properly enforce SSO login authorization for locally disabled user accounts, permitting disabled users to maintain application access through single sign-on mechanisms. This affects Kiuwan Cloud and Kiuwan SAST on-premise (KOP) versions prior to 2.8.2509.4, enabling authenticated attackers with prior credentials to bypass account disablement controls. An attacker whose account has been disabled by administrators can re-authenticate via SSO and regain unauthorized access to the system.
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perform actions with the privileges of other users. The vulnerability stems from missing authentication middleware on certain endpoints, enabling attackers on the local network (AV:A) to impersonate legitimate users without requiring credentials. No public exploit code or active exploitation has been confirmed at this time.
Authentication bypass in Siemens SINEC NMS versions prior to V4.0 SP3 with UMC allows unauthenticated remote attackers to gain unauthorized access due to insufficient user identity validation in the UMC component (CWE-347: Improper Verification of Cryptographic Signature). The vulnerability enables network-based attacks with low complexity requiring no user interaction (CVSS 7.3, AV:N/AC:L/PR:N/UI:N), granting partial access to confidentiality, integrity, and availability. ZDI tracking ID CAN-27564 suggests coordinated disclosure. No active exploitation (CISA KEV) or public exploit code confirmed at time of analysis, though JWT-related authentication bypasses are well-understood attack primitives.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
MaxKB versions 2.7.1 and below allow authenticated users to spoof tool execution results by exploiting Python frame introspection to extract the wrapper's UUID from bytecode, then writing forged output directly to file descriptor 1 to bypass stdout redirection and terminate the wrapper process before legitimate output is generated, causing the service to trust the attacker-controlled response. This integrity bypass requires prior authentication and local/network access but enables attackers to manipulate AI tool results without detection. The vulnerability has been patched in version 2.8.0.
Authorization bypass in sigstore/timestamp-authority verifier allows attackers to prepend forged certificates to PKCS#7 certificate bags, causing the library to validate signatures with one certificate while performing authorization checks on another. The vulnerability affects the `VerifyTimestampResponse` function in timestamp-authority/v2/pkg/verification, enabling attackers to bypass authorization controls on timestamp verification. This impacts only library consumers, not the timestamp-authority service itself, and sigstore-go is unaffected due to its use of the `TSACertificate` mitigation option. EPSS 5.5, actively exploitable via local interaction.
Input validation bypass in jq command-line JSON processor allows attackers to craft JSON with embedded NUL bytes that jq incorrectly truncates, validating only a benign prefix while silently discarding malicious trailing data. Versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are affected; the vulnerability enables parser differential attacks where jq validates hostile input as safe JSON, but downstream consumers process the complete input including injected payloads. With low CVSS (2.9) and attack timing complexity, exploitation risk remains moderate in scenarios where jq serves as a validation gate for untrusted JSON forwarded to other processors.
SAP S/4HANA frontend OData Service (Manage Reference Structures) allows authenticated users to update and delete child entities without proper authorization checks, enabling privilege escalation and data integrity violations. The vulnerability requires valid user credentials but no special privileges, affecting systems running vulnerable S/4HANA versions. Attackers can exploit exposed OData endpoints to modify or remove reference structure data that should be protected from their access level.
SAP S/4HANA backend OData Service for Manage Reference Structures allows authenticated remote attackers to modify and delete child entities without proper authorization checks, compromising data integrity across reference data structures. The vulnerability requires valid user credentials but no elevated privileges, affecting organizations running vulnerable S/4HANA versions. CVSS 6.5 with confirmed patch availability via SAP Security Patch Day.
SAP S/4HANA OData Service for Manage Reference Equipment lacks authorization checks, allowing authenticated users to modify and delete child entities without proper access controls. The vulnerability affects S/4HANA instances with the vulnerable OData service and requires low-privilege network access, resulting in high integrity impact but no confidentiality or availability risk. No public exploit code or active exploitation has been confirmed.
SAP S/4HANA OData Service for Manage Technical Object Structures allows authenticated users to update and delete child entities without proper authorization checks, enabling unauthorized data modification. The vulnerability affects S/4HANA deployments exposing the vulnerable OData service and requires valid user credentials but no elevated privileges. CVSS base score is 4.3 (low-to-medium severity) with confirmed patch availability from SAP Security Patch Day.
SAP S/4HANA (Private Cloud and On-Premise) allows authenticated local network users to delete arbitrary operating system files due to missing authorization checks, degrading system integrity and availability. The vulnerability requires prior authentication and high complexity attack conditions (AC:H), resulting in a CVSS score of 4.9. No evidence of active exploitation or public proof-of-concept code has been identified, but the authorization bypass is confirmed across both deployment models.
Material Master application fails to enforce authorization checks for authenticated users executing reports, allowing disclosure of sensitive information to any authenticated user regardless of intended access permissions. Affects SAP Material Master with CVSS 4.3 (low severity) and confirmed authentication requirement; no active exploitation reported. Remote attackers with valid credentials can access restricted report data without additional attack complexity.
Insecure session management in SAP Business Objects Business Intelligence Platform allows unauthenticated attackers to obtain and reuse valid session tokens, enabling unauthorized access to victim sessions with moderate complexity. An attacker exploiting this vulnerability could access or modify information within the compromised session's scope, affecting confidentiality and integrity. The attack requires user interaction (UI:R) and high attack complexity (AC:H), limiting real-world exploitation but still warranting prioritized remediation for organizations running affected BI Platform versions.
Missing authorization checks in SAP Business Analytics and SAP Content Management allow authenticated users to invoke unauthorized remote function module calls, enabling confidential data access beyond their assigned permissions. The vulnerability affects all versions of the product and carries a CVSS score of 6.5 with confirmed high confidentiality impact. No public exploit code or active exploitation has been reported at time of analysis.
Improper authorization in Snipe-IT v8.4.0 allows authenticated attackers holding the users.edit permission to overwrite sensitive authentication and account-state fields on arbitrary non-admin user accounts via a crafted PUT request to /api/v1/users/{id}. A publicly available proof-of-concept exists (SSVC: poc), enabling low-complexity account manipulation or effective takeover of regular user accounts without requiring admin privileges. The vulnerability is not confirmed in CISA KEV, and with an EPSS of 0.03% (8th percentile) widespread automated exploitation appears unlikely at this time, though the POC lowers the barrier to targeted misuse.
Insecure Direct Object Reference in EspoCRM 9.3.3 and earlier allows any authenticated user holding Email:create and Import permissions to read arbitrary attachment records owned by other users via the POST /api/v1/Email/importEml endpoint. The attacker supplies a victim's fileId, which the endpoint accepted without ACL validation and passed directly to the import service - importing the victim's .eml contents into the attacker's mailbox while simultaneously deleting the original victim attachment record as a side effect. A public proof-of-concept is available via the vendor's GitHub security advisory; EPSS remains at 0.02% (5th percentile), consistent with SSVC's 'Automatable: no' designation and no confirmed active exploitation at time of analysis.
Unauthenticated asset disclosure in Note Mark exposes full binary contents of private note attachments to any party who possesses both the note UUID and asset UUID. The GET route at `/api/notes/{noteID}/assets/{assetID}` was registered without authentication middleware in `handlers/assets.go`, and the backend SQL query (`SELECT * FROM note_assets WHERE id = ? AND note_id = ?`) omits any JOIN against `notes` or `books`, meaning book ownership and visibility are never verified. No active exploitation is confirmed in CISA KEV, but a proof-of-concept exists per SSVC assessment, and the fix is available in v0.19.2.
Improper access control in CodeAstro Online Job Portal 1.0 enables any authenticated user to delete job postings owned by other users by manipulating the `ID` parameter in requests to `/jobs/job-delete.php`. A proof-of-concept exploit is publicly available on GitHub. Despite the network-accessible attack vector, real-world risk is constrained by the authentication requirement, the low EPSS score (0.04%, 11th percentile), and the niche deployment footprint of this PHP application - no CISA KEV listing and no active exploitation signals have been observed.
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation, allowing malformed or invalid UTF-8 sequences in BSON data to bypass validation checks. This affects MongoDB C Driver versions prior to 1.30.5, 2.0.0, and 2.0.1, and impacts applications that depend on this validation function to process untrusted BSON data. Authenticated remote attackers can exploit this to inject invalid BSON data, potentially causing integrity issues in downstream processing; EPSS 0.48 indicates this is a moderate-priority issue that warrants patching but is not among the highest-risk vulnerabilities.
Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to bypass Extend Unlock authentication due to incorrect privilege assignment, enabling unauthorized device access without requiring prior authentication. The vulnerability requires physical proximity and user interaction but grants full confidentiality and integrity compromise of the device. No public exploit code has been identified at the time of analysis.
Samsung Mobile's Recents application prior to SMR Apr-2026 Release 1 fails to properly validate exceptional conditions, allowing a physical attacker to bypass App Pinning security controls. The vulnerability requires physical device access and has a CVSS score of 4.1 reflecting the physical attack vector and confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Device Care in Samsung Mobile devices prior to the April 2026 SMR Release 1 contains an improper exception handling vulnerability that permits physical attackers to bypass Knox Guard authentication enforcement. With a CVSS score of 4.4 and attack vector requiring physical access, this vulnerability poses a localized but serious integrity and confidentiality risk to device security architecture, particularly for devices left unattended or in corporate environments where physical access controls may be compromised.
Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypass network restrictions without authentication. The vulnerability affects data handling related to network restriction policies, enabling unauthorized modification of network access controls. CVSS score of 5.2 reflects the physical attack requirement, though integrity and availability impacts are rated high for affected functions.
Improper access control in Huawei HarmonyOS memo module allows local, unauthenticated users to bypass authentication and read sensitive memo data, affecting confidentiality and system availability. The vulnerability requires user interaction (UI interaction flag set) and involves high attack complexity, resulting in a CVSS score of 4.1. No public exploit code or active exploitation has been confirmed at time of analysis.
Authentication bypass in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows remote unauthenticated attackers to manipulate the Agent Mode Service component, resulting in missing authentication checks (CWE-306). Publicly available exploit code exists, and the vulnerability has been reported to the project without response. CVSS 6.9 reflects moderate confidentiality, integrity, and availability impact with network-accessible attack vector and no user interaction required.
Missing authentication in zhayujie chatgpt-on-wechat CowAgent 2.0.4 administrative HTTP endpoint allows remote attackers to bypass access controls and perform unauthorized administrative operations without credentials. Publicly available exploit code exists. EPSS risk not available; CVSS 7.3 reflects network-based attack requiring no privileges or user interaction. The vendor has not responded to the vulnerability disclosure (GitHub issue #2733) at time of analysis.
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.
Net::CIDR::Lite before version 0.23 for Perl incorrectly handles RFC 4291 IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) by including an extra sentinel byte during packing, resulting in 18-byte instead of 17-byte representations. This misalignment causes the find() and bin_find() functions to return incorrect matching results during IP address lookup operations, enabling attackers to bypass IP-based access control lists by crafting addresses that fall outside intended CIDR ranges. No active exploitation has been identified, but the low EPSS score (0.02%) masks the authentication bypass tag, suggesting limited real-world triggering conditions despite the 6.5 CVSS score.
Microsoft Edge (Chromium-based) on Android contains a user interface misrepresentation vulnerability that allows unauthenticated remote attackers to conduct spoofing attacks over a network. The vulnerability exploits UI rendering to misrepresent critical information to end users, enabling attackers to deceive users into taking unintended actions. While the CVSS score is moderate (5.4), the attack requires user interaction and only impacts confidentiality and integrity; a vendor-released patch is available.
Temporal's frontend gRPC server fails to enforce authentication and authorization on the StreamWorkflowReplicationMessages endpoint, allowing unauthenticated network attackers to establish replication streams and potentially exfiltrate workflow data when replication targets are configured. The vulnerability affects Temporal versions prior to 1.28.4, 1.29.6, and 1.30.4; Temporal Cloud deployments are unaffected. While exploitation requires knowledge of cluster configuration and correctly configured replication targets, the authentication bypass on a network-accessible service combined with a moderate CVSS score (6.3) reflects the practical risk of unauthorized data access in multi-tenant or sensitive workflow environments.
Broken Access Control in FastGPT versions prior to 4.14.10.4 allows authenticated teams to access and execute applications belonging to other teams by supplying a foreign application ID, enabling cross-tenant data exposure and unauthorized workflow execution. The vulnerability stems from insufficient API validation-while team tokens are verified, the API fails to confirm that the requested application belongs to the authenticated team. This affects all FastGPT instances with multi-tenant deployments where different teams manage separate AI Agent applications, and is fixed in version 4.14.10.4.
ClearanceKit for macOS prior to version 5.0.4-beta-1f46165 fails to validate destination paths in dual-path file operations (rename, link, copyfile, exchangedata, clone), allowing authenticated local processes to bypass file-access protection and place or replace files in protected directories. The vulnerability affects all versions before 5.0.4-beta-1f46165 and has been patched; no public exploit code or active exploitation has been identified at the time of analysis.
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unauthenticated remote attackers to enumerate and access private photo collections through direct URL access. The vulnerability is restricted to information disclosure with low impact due to attack complexity constraints, though it exposes sensitive travel-related imagery that users expect to be private.
Remote authentication bypass in Ajenti prior to version 0.112 allows unauthenticated network attackers to circumvent two-factor authentication during a brief post-authentication window with high attack complexity. The vulnerability affects the core authentication mechanism in ajenti.plugin.core and permits attackers to gain high-confidence access to protected resources; the vendor released patched version 0.112 to resolve this issue.
Chamilo LMS versions prior to 2.0.0-RC.3 allow authenticated students and lower-privileged users to enumerate all platform users and extract sensitive personal information (email addresses, phone numbers, role assignments) through an unauthenticated API endpoint (GET /api/users), enabling reconnaissance of administrator accounts and organizational structure. The vulnerability affects any installation with user accounts below administrative level and is fixed in version 2.0.0-RC.3.
Chamilo LMS REST API endpoint get_user_info_from_username fails to authorize requests, exposing personal information (email, names, user ID, active status) to any authenticated user regardless of role prior to version 1.11.38. An attacker with valid login credentials, including a student account, can enumerate and retrieve sensitive user data for any account in the system.
Insecure Direct Object Reference in Chamilo LMS REST API stats endpoint allows authenticated low-privilege users to read unauthorized access to any user's learning progress, certificates, and gradebook scores across all courses prior to version 2.0.0-RC.3. The vulnerability requires only valid user credentials (accessible to students with ROLE_USER) and network access, enabling horizontal privilege escalation without administrative intervention or system compromise. No public exploit code or active exploitation has been identified at time of analysis.
OpenClaw before version 2026.3.22 allows authenticated attackers to redirect webhook-triggered chat replies to unintended users by exploiting username-based recipient binding instead of stable numeric identifiers. An attacker with valid credentials can manipulate username changes to rebind webhook replies intended for one user to a different user, compromising message confidentiality and integrity. No public exploit code or active CISA exploitation data is available, but the vulnerability is confirmed patched by the vendor.
OpenClaw before version 2026.3.25 contains an authentication bypass vulnerability in the raw card send surface that allows unauthenticated remote attackers to send malformed card commands, bypassing DM pairing restrictions and reaching callback handlers without proper authorization. This enables unpaired recipients to mint legacy callback payloads, resulting in integrity compromise of the messaging protocol. No public exploit code or active exploitation has been confirmed, but the low attack complexity and network accessibility make this a practical vulnerability.
OpenClaw before version 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing authenticated leaf subagents to bypass access control and message child sessions beyond their authorized scope. An authenticated attacker with subagent privileges can exploit this via the send action to communicate with restricted child sessions without proper validation, resulting in unauthorized inter-session message relay. No public exploit code has been identified, but the vulnerability has a moderate CVSS score of 4.3 reflecting the integrity impact and low attack complexity.
OpenClaw before 2026.3.25 allows remote attackers to bypass Telegram direct message pairing requirements and mutate session state through weaker callback-only authorization mechanisms. An unauthenticated attacker can craft malicious Telegram callback queries in direct messages to modify session state without satisfying the normal DM pairing security controls, resulting in unauthorized state modification with CVSS 5.3 (medium severity).