Authentication Bypass
Monthly
Authorization bypass in the Grav Flex Objects plugin (versions 1.4.0-1.4.7) allows any user holding page-edit access to render arbitrary registered Flex collections - including the full user account directory - by embedding a shortcode in published pages. The shortcode rendering path entirely omits the `authorize` ACL checks enforced in the admin panel, meaning lower-privileged editors can extract sensitive data that would otherwise be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis, but the low privilege bar and network accessibility make this a credible insider or compromised-account threat on multi-author Grav installations.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories` permission to mint tokens scoped to arbitrary organizations' private packages. The flaw in `validate_scopes_against_key/2` accepted any scope string prefixed with `repository:` without resolving the organization name against the authenticated principal's actual memberships; because CDN edges evaluate repository access from token claims alone without querying the database, a minted token grants persistent read access to the targeted organization's private packages until expiration. No public exploit code has been identified at time of analysis, but the vulnerability mechanics are fully disclosed in the public advisory and patch diff.
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect `required()` field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. Email-based MFA is unaffected; no public exploit or CISA KEV listing exists at time of analysis, though the logic flaw is straightforward and the fix is trivially reversible to derive an exploit.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to bypass access restrictions and gain unauthorized access to protected resources on the affected thin client system. The CVSS score of 7.8 (High) reflects complete confidentiality, integrity, and availability impact upon successful exploitation, despite requiring only local, low-privilege access with low attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. A publicly available exploit writeup documents the full technique (codeant.ai, VulnCheck); no CISA KEV listing is recorded at time of analysis.
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expense-creation rights to self-approve their own expense reports by directly manipulating workflow state fields, including approval status and approver identity. All Dolibarr versions before 24.0.0 are affected; a publicly available proof-of-concept exploit demonstrates the bypass. While not listed in CISA KEV, the publicly available exploit and the financial integrity impact - including forged audit records and missing approval timestamps - make this a meaningful risk for organizations running Dolibarr for financial operations.
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payroll fields - salary, bonus, hourly rate, daily rate, and weekly hours - for arbitrary user records, bypassing intended payroll-role access controls. All Dolibarr versions before 24.0.0 are affected due to an incomplete field denylist that fails to exclude payroll columns from mass-assignment in the API layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation has been recorded in CISA KEV at the time of analysis, but vendor-released patch version 24.0.0 is available.
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. Publicly available exploit code exists per VulnCheck and codeant.ai research; the vulnerability is not yet listed in CISA KEV but the financial impact potential elevates real-world priority above the 7.1 CVSS score alone suggests.
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any authenticated user holding invoice-deletion rights, regardless of whether they possess payment-issuance rights. All Dolibarr installations prior to version 24.0.0 are affected. Exploitation results in permanent removal of payment records, zeroing of paid invoice amounts, and corruption of accounting exports - a high-integrity, high-availability financial data loss. Publicly available exploit code exists, lowering the attack barrier; active exploitation has not been confirmed by CISA KEV at time of analysis.
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any authenticated user holding third-party creation rights to overwrite the WebPortal password of any company in the system, regardless of ownership. After replacing the password, the attacker can log into the victim company's WebPortal and access its invoice data; the write endpoint also returns the victim's previous password verifier, enabling potential offline credential attacks. A public proof-of-concept is available; no confirmed active exploitation (CISA KEV) at time of analysis, but the low attack complexity and available PoC make this a genuine priority for all pre-24.0.0 deployments.
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. A publicly available proof-of-concept exists; no active exploitation has been confirmed in CISA KEV at the time of analysis.
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-7x63-xv5r-3p2x); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.
Unauthorized operation vulnerabilities in multiple DrayTek VigorSwitch managed switch models allow unauthenticated remote attackers to manipulate device state - including modifying configuration, restarting services, overwriting startup configuration, and clearing audit logs - without any authentication. Affecting at least 28 named VigorSwitch models across the G, P, PQ, Q, and FX series, the root cause is missing authorization checks in multiple syslog-related HTTP handler functions (CWE-862). The CVSS 4.0 score of 8.8 with AV:N/PR:N/UI:N confirms the full attack surface is exposed to any network-reachable attacker, with no public exploit or CISA KEV listing identified at time of analysis.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch exists in WebTop 1.5.7.
Unauthenticated administrator account registration in rConfig 8.0.0 through the affected releases lets any remote attacker create a fully privileged Admin user by hitting a POST /register route that was supposed to be disabled. A duplicate bare Auth::routes() call in routes/web.php re-enables self-registration, and because the registration controller never assigns a role while the users.role column defaults to Admin, the new account is instantly authenticated with full administrative rights. Reported by VulnCheck; no public exploit identified at time of analysis, but the flaw is trivially reachable and grants access to stored device credentials, user data, and API token issuance.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
Improper authorization in TIM Flow before 26.0.6 exposes a privileged dashboard Excel export endpoint to exploitation by any authenticated user, enabling arbitrary SQL query execution against the application database. The missing server-side authorization check (CWE-862) allows non-administrative accounts to craft SQL SELECT statements, submit them to the export endpoint, and receive full query results as a downloadable spreadsheet, effectively granting unrestricted read access to the database. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this immediately actionable by any account holder.
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated low-privileged user modify the application's config/generic.json, tampering with notification, LDAP, SMTP, and general settings. Because the endpoint enforces only that a session exists - with no administrator/privilege check (CWE-862) - a compromised or intentionally low-tier account can redirect integrations, alter authentication-related settings, or knock the installation offline. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; the vendor CVSS 4.0 base score is 9.4.
Authentication bypass in phpIPAM's REST API before 1.8.2 lets unauthenticated remote attackers obtain full API access by abusing an object-cache key collision, then wielding a numeric database row ID as a valid API token to read, write, and delete all IP address management records. VulnCheck reported the flaw and the vendor shipped a fix in 1.8.2; a patch commit is public, so publicly available exploit code exists in the sense of a documented, reproducible technique, though no active exploitation is confirmed. With a CVSS 4.0 base of 9.3 and no authentication or user interaction required, this is a high-priority issue for internet- or network-exposed phpIPAM instances.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets through public notification channels (Rocket.Chat, Mastodon, Bluesky, email) and the public MISP feed, due to incomplete privacy enforcement at the entity level rather than the post level. The post-processing logic in posts.py checked only the individual post's private flag, leaving freshly parsed victims of private groups and markets unprotected because new posts arrive with private=False. A parallel defect in misp_feed.py restricted its privacy check to the group database only, so victims of private markets were admitted to the public MISP feed. No public exploit is identified at time of analysis; this is a passive information-disclosure flaw - subscribers to the affected channels receive the leaked data automatically without taking any active exploitation step.
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the exploitable code paths are visible in public source and trivially reproducible.
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any remote user who can reach the web application to pull records marked private. The legacy /export/<database> route exports selected internal databases without authentication and does not consistently apply the app's private-entity access restrictions, so private groups, markets, and posts can leak. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/group/new endpoint, which lacked Flask-Login's login_required decorator that guards other admin routes. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation requiring no credentials or user interaction. No public exploit identified at time of analysis and no CISA KEV listing, but the trivially low barrier - any attacker who can reach the web interface qualifies - elevates practical risk for publicly exposed instances, with high availability impact (VA:H) suggesting unbounded entry injection could degrade application usability.
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user of one company read, modify, and even hijack supplier records belonging to other companies by sending a PUT to /api/supplier/{id} and supplying an arbitrary company_id in the body. The supplier lookup was not scoped to the caller's tenant and mass-assignment allowed re-parenting a record to the attacker's own company, breaking multi-tenant isolation. A vendor patch exists (5.3.2) and the fix is visible in a public GitHub commit; there is no public exploit identified and it is not on CISA KEV, but the flaw is trivially reproducible from the diff.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
Broken access control in the Notification Master WordPress plugin (versions ≤ 1.7.1) exposes restricted functionality to unauthenticated remote attackers, resulting in high confidentiality impact with no authentication required. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that any network-accessible attacker can trigger the flaw with low complexity, likely exposing sensitive notification configuration data such as subscriber email addresses, phone numbers, or webhook endpoints stored by the plugin. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated information disclosure in KAON PG5298A and PG5298B router firmware exposes the administrative portal password to any attacker on the same local network segment. An adjacent-network attacker can query a specific firmware endpoint without credentials and retrieve sensitive authentication material, enabling full device takeover. Vendor-released patches are available in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The `verify()` VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix.
Cross-client template disclosure in Ghostwriter before 7.1.2 allows authenticated users to exfiltrate proprietary report templates belonging to other clients managed within the same platform instance. The report template swap endpoint failed to enforce ownership validation, accepting user-controlled template primary keys without verifying client-scope alignment. Because template PKs are sequential integers, an attacker with any authenticated access can enumerate foreign template IDs, attach them to their own reports, and trigger report generation to read sensitive client deliverable content - including letterhead, boilerplate legal text, and pentest methodology. No public exploit identified at time of analysis, though VulnCheck has published an advisory and a researcher (geo-chen) has documented the issue in a public repository.
Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled input reintroduce active HTML and JavaScript, resulting in cross-site scripting in consuming web applications. The flaws span URL-sanitization helpers, HTML serialization, Markdown passthrough, and custom policies - most do NOT affect the default sanitize=True path but do affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed in 1.15.0.
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 High rating with C:H/I:H/A:H captures the potential for full kernel-level impact on affected systems.
Race condition in the Linux kernel's ring-buffer subsystem (ring_buffer_swap_cpu()) allows a local low-privileged user to trigger inconsistent kernel buffer state, potentially leading to kernel memory corruption or system crash. The flaw exists because the committing counter used to guard against concurrent buffer swaps transiently drops to zero within rb_move_tail(), opening an interrupt-driven window where a swap can succeed mid-write. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates negligible current exploitation pressure - but the local PR:L attack vector with C:H/I:H/A:H impact makes this significant on multi-tenant Linux systems where tracing interfaces are accessible.
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enumerate arbitrary server-side directories, exposing file system structure without credentials or user interaction. All versions from 1.0.0 through 4.7.1 are affected across the extension's full release history; version 4.7.2 was released to remediate the flaw. No public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis, though the unauthenticated network-accessible nature of the endpoint lowers the bar for opportunistic reconnaissance by automated scanners.
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote attacker to destroy data by issuing a single HTTP GET request to the list.doempty controller action. The endpoint lacks all ACL gates, making exploitation trivially automatable against any publicly accessible Joomla installation running the affected component. No public exploit has been identified at time of analysis, but the absence of any authentication or complexity barrier means the effective exploitation threshold is near zero.
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation path makes it high-priority for Joomla sites running Fabrik.
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, column listings, and the Joomla database table prefix to any remote attacker without credentials. The vulnerable ajax_tables method in the extension's elements model responds to AJAX requests without enforcing access control, violating the principle of least privilege (CWE-284). No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low attack complexity and the high value of schema metadata for downstream attacks.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
Scope and grant-type escalation in the Punk::OAuth2::Server Perl module (through version 0.03) lets a registered OAuth2 client obtain correctly signed at+jwt access tokens carrying scopes and grant types it was never registered for. Because the token endpoint dispatches on the request-body grant_type and passes the requested scope straight to the token minter without checking it against the client's registration, and because authorize copies the query scope into the authorization-code record unchecked, any client can mint over-privileged tokens that a Punk::OAuth2::Checker resource server will accept and honour. There is no public exploit identified at time of analysis and EPSS risk is low (0.20%), but the flaw is authorization-model-breaking and remotely reachable.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Authentication bypass in the SmilePass Selfie Login WordPress plugin (all versions through 1.0.2) lets an unauthenticated attacker log in as any registered account, including administrators. The plugin trusts a client-supplied identity for its selfie-based login flow and performs no server-side verification, so a request simply asserting a target username is accepted. Rated CVSS 9.8; no public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), indicating no widespread automated exploitation observed yet.
Full authentication bypass in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (versions up to and including 1.2.0) lets a remote unauthenticated attacker mint a valid session for any existing user, including administrators. Because one publicly reachable login handler performs no authentication, authorization, or nonce validation, an attacker can take over the site's original admin account in the default configuration without knowing any credentials. EPSS is low (0.19%, 9th percentile) and no public exploit is identified at time of analysis, but the CVSS 9.8 rating reflects trivial, high-impact site takeover.
Authentication bypass in the WP Social Media Login WordPress plugin (versions through 1.0.6) lets unauthenticated attackers log in as any existing user, including administrators, simply by supplying that user's email address. The plugin trusts a claimed social-login identity without verifying that authentication actually completed with the identity provider, so no valid OAuth flow or credentials are needed. Reported by WPScan and rated CVSS 9.8; no public exploit or active exploitation has been identified, and EPSS remains low at 0.15%.
Authentication bypass in the Firebase Authentication WordPress plugin (all versions before 1.7.1) permits unauthenticated remote attackers to impersonate any WordPress account - including administrators - by presenting an unverified Firebase JWT whose email claim matches a WordPress user. The plugin fails to check the `email_verified` field before binding the Firebase identity to a WordPress session, enabling account takeover without knowledge of the target's password. No public exploit is identified at time of analysis and EPSS sits at 0.20% (11th percentile), but the unauthenticated admin takeover potential makes this a high-priority patch for any site running the affected plugin.
Remote administrative account takeover in the ManageWP Worker WordPress plugin (versions before 4.9.37) is possible because login links are neither bound to a specific user account nor invalidated after first use, enabling replay attacks. Any attacker who intercepts or obtains a ManageWP-generated login link - whether it has been previously used or not - can replay it to establish an authenticated session as any WordPress user on the target site, including administrators. No public exploit has been identified at time of analysis, and the vendor-released patch (4.9.37) is available.
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) allows any peer with access to the cluster network to inject or replay MsgReplicateSync messages, silently corrupting replicated telemetry data across all cluster nodes. The CVSS 4.0 score of 8.3 reflects high integrity impact on both the vulnerable system and subsequent cluster peers (VI:H, SI:H) with only low privilege requirements, scoped to cluster-mode deployments. A vendor-released patch is available in version 2026.06.1; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote PHP file execution in Combodo iTop prior to 3.2.3 allows attackers to invoke arbitrary PHP files from the env-production module directory by sending crafted requests to the exec.php dispatcher, which performed no authentication check before routing to module pages. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N), indicating zero-friction network exploitation with no credentials required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing object-level authorization in Combodo iTop prior to 3.2.3 allows authenticated users to retrieve IT management objects outside their permitted access scope via the search interface. The flaw resides in AjaxRenderController::GetDataForTable(), which returned DBObjectSet results without calling UserRights::IsActionAllowed() - confirmed by the fix commit. No public exploit has been identified at time of analysis, but the low-privilege, network-accessible attack path makes this a credible threat for any multi-tenant or role-segmented iTop deployment.
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privilege RoleMember attach to another user's live WebSocket terminal or file-manager session and gain interactive shell access and full file read/write on the monitored target server. The flaw stems from stream UUIDs at GET /ws/terminal/:id and GET /ws/file/:id being validated only for existence, never bound to their creating user, so an attacker who learns a live UUID from access logs, referer headers, browser history, or telemetry breadcrumbs achieves cross-tenant remote code execution. Fixed in v2.0.10; no public exploit identified at time of analysis, though the upstream commit and its regression tests fully disclose the mechanism.
Unauthenticated resource exhaustion in Keystone CMS (Node.js) prior to version 6.5.3 allows any remote GraphQL client to bypass the configured `graphql.maxTake` record-count limit by supplying a negative `take` value, since the comparison `(take ?? Infinity) > maxTake` evaluates to false for negative integers regardless of their magnitude. The bypass applies to both top-level list queries and relationship sub-queries, enabling an attacker to force the server to retrieve an unbounded number of database records and exhaust service resources. No public exploit code has been identified at time of analysis, though the fix and advisory are publicly available.
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low post-enumeration technical barrier makes this a meaningful credential-exposure risk for any internet-facing Craftplan instance.
Unauthenticated remote access to uploaded documents is possible in Combodo iTop versions prior to 3.2.3 due to a missing authentication check in the ajax.document.php endpoint. The commit diff confirms that LoginWebPage::DoLoginEx() was absent from critical code paths that serve uploaded files, allowing any network-reachable user who obtains a valid document URL to download sensitive content without credentials. No public exploit code has been identified at time of analysis, but the attack is technically trivial given the low-complexity, unauthenticated CVSS vector.
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Domain and OAuth-credential hijacking in the Jet Admin no-code internal-tools platform lets a remote attacker create their own malicious app, bind it to a victim's configured custom domain, alter the authentication configuration, and silently reroute the victim's traffic to attacker-controlled logic. Because the takeover also copies the victim's OAuth Client ID and Client Secret into the attacker's workspace, it doubles as a credential-theft primitive against any tenant using an OAuth identity provider. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in Spring AI's tool-calling layer allows a tool that was never advertised to the current request to be dispatched and invoked, which can escalate privileges when the out-of-boundary tool carries greater capabilities than the caller was granted. Affected are Spring AI 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0 (CPE cpe:2.3:a:vmware:spring_ai) in applications that actually use tool calling with a per-request tool list that restricts at least one tool relative to others, and where the attacker can influence the model's input; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (high attack complexity, unauthenticated) rather than the vendor's headline 9.8 AV:N/AC:L score, reflecting that exploitation is conditional ('under certain conditions') and not universally reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is low at 0.17% (7th percentile), and CISA SSVC rates Exploitation as none and Automatable as no, though Technical Impact is total. Realized impact is bounded by the authority of whatever tool slips past the boundary.
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared instance to read financial transaction records belonging to other companies by iterating the integer ID in GET /api/transaction/{id}, which performed no company-scoping and no permission check. Source code analysis of the fix confirms the vulnerable controller called Transaction::find($id) directly against the full dataset, making every transaction on the instance reachable to any valid session. No CISA KEV listing exists and no public exploit code has been identified, though the trivial exploitation pattern (sequential integer enumeration) requires minimal skill.
Cross-user memory disclosure and tampering in Headroom's LLM proxy (versions before 0.36.1) lets a caller read or overwrite any user's stored LLM memory by simply naming another user's identifier in the client-supplied x-headroom-user-id request header. The proxy trusts this header as the authenticated identity across the chat-completion and websocket data-plane paths in headroom/proxy/handlers/openai.py, with nothing binding the value to the actual caller. The console script binds loopback by default, but the shipped docker-compose.yml publishes the proxy on 0.0.0.0 with no required proxy token, so a stock Docker deployment exposes these routes to the network unauthenticated. Reported by VulnCheck; no public exploit identified at time of analysis.
Cross-organization report data exposure in OpenPanel allows any authenticated user to read all analytics reports belonging to another organization's dashboard by supplying a mismatched projectId and dashboardId pair to the report.list tRPC procedure. The enforceAccess middleware validated only project membership, not dashboard ownership, while the underlying getReportsByDashboardId query applied no project-scoping filter - enabling a classic IDOR across tenant boundaries. No public exploit has been identified and no CISA KEV listing exists, but the attack requires only a valid session and knowledge of a foreign dashboardId, making it low-friction in multi-tenant deployments.
Insecure direct object reference in OpenPanel's tRPC report.get procedure exposes any saved report's full configuration to any authenticated instance user. The enforceAccess middleware in packages/trpc/src/trpc.ts conditionally evaluates project membership only when the input carries a projectId or organizationId key; since report.get accepted only a reportId, it bypassed all authorization checks, and the underlying getReportById query performed no project-level scoping. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack pattern is trivially reproducible by any authenticated developer familiar with tRPC.
Unauthenticated remote enumeration of all penetration-testing projects and client organisations is possible in Reconmap due to a misapplied [AllowAnonymous] attribute on the report preview endpoint, overriding the application-wide administrator-role policy. Any unauthenticated caller can issue sequential GET requests to /reports/{id}/preview and receive rendered HTML containing project names, descriptions, and linked client organisation names, addresses, and URLs; 404 responses for missing IDs further confirm which project IDs exist, enabling complete database enumeration. No CISA KEV listing or public exploit code has been identified at time of analysis, but the trivial attack mechanics - sequential HTTP GETs requiring no credentials or tooling - make exploitation highly accessible to any network-adjacent attacker.
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to any authenticated CloudStack user. Affected APIs - deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, updateVirtualMachine, and (from 4.21.0.0) deleteCniConfiguration - fail to validate that the requesting account owns the target userdata resource, enabling one tenant to read, delete, or manipulate another tenant's userdata. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.13% at the 3rd percentile indicates low automated exploitation activity to date, though the multi-tenant cloud infrastructure context makes successful exploitation high-impact for affected operators.
Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating outside their assigned domain scope. Authenticated Domain Admins can create, update, delete, and enumerate project roles and role permissions for projects belonging to entirely unrelated domains, because the authorization check validates only that the caller holds the Domain Admin role without confirming the target project falls within their domain or any subdomain hierarchy. Affected versions span 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0; no public exploit has been identified at time of analysis and EPSS probability is very low at 0.13%.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Execution After Redirect (EAR) in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel enables unauthenticated network attackers to bypass authentication controls and access protected administrative content through version 28072026. The flaw exploits a server-side logic error where HTTP redirect responses intended to gate access to the login page continue executing and rendering protected page content, which an attacker can read before following the redirect. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the risk is primarily elevated by the unauthenticated, low-complexity network vector.
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
Unauthenticated arbitrary file upload in Datiphy Data Management Center v8.3.0 through v8.5.1 exposes the upload API endpoint without any authentication enforcement, permitting remote attackers to write arbitrary files directly to the server's configured upload directory. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by ZUSO ART and registered as ENISA EUVD-2026-63792. The CVSS 4.0 vector scores network-accessible, zero-complexity, unauthenticated exploitation with high integrity and availability impact; no public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection and authentication bypass in Genians Genian NAC (V4.0, V5.0) and ZTNA (V6.0) expose sensitive backend data to remote unauthenticated attackers via crafted data queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites, consistent with the authentication bypass tag. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the unauthenticated, low-complexity nature warrants prompt patching across all three product lines.
Authentication bypass in PTC Windchill Risk and Reliability (WRR) Enterprise Edition allows remote attackers to reach critical functionality without valid credentials, per CVSS 4.0 AV:N/PR:N metrics. The flaw stems from missing authentication (CWE-306) and carries a critical 9.3 score with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in the Grav Flex Objects plugin (versions 1.4.0-1.4.7) allows any user holding page-edit access to render arbitrary registered Flex collections - including the full user account directory - by embedding a shortcode in published pages. The shortcode rendering path entirely omits the `authorize` ACL checks enforced in the admin panel, meaning lower-privileged editors can extract sensitive data that would otherwise be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis, but the low privilege bar and network accessibility make this a credible insider or compromised-account threat on multi-author Grav installations.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories` permission to mint tokens scoped to arbitrary organizations' private packages. The flaw in `validate_scopes_against_key/2` accepted any scope string prefixed with `repository:` without resolving the organization name against the authenticated principal's actual memberships; because CDN edges evaluate repository access from token claims alone without querying the database, a minted token grants persistent read access to the targeted organization's private packages until expiration. No public exploit code has been identified at time of analysis, but the vulnerability mechanics are fully disclosed in the public advisory and patch diff.
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect `required()` field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. Email-based MFA is unaffected; no public exploit or CISA KEV listing exists at time of analysis, though the logic flaw is straightforward and the fix is trivially reversible to derive an exploit.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to bypass access restrictions and gain unauthorized access to protected resources on the affected thin client system. The CVSS score of 7.8 (High) reflects complete confidentiality, integrity, and availability impact upon successful exploitation, despite requiring only local, low-privilege access with low attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. A publicly available exploit writeup documents the full technique (codeant.ai, VulnCheck); no CISA KEV listing is recorded at time of analysis.
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expense-creation rights to self-approve their own expense reports by directly manipulating workflow state fields, including approval status and approver identity. All Dolibarr versions before 24.0.0 are affected; a publicly available proof-of-concept exploit demonstrates the bypass. While not listed in CISA KEV, the publicly available exploit and the financial integrity impact - including forged audit records and missing approval timestamps - make this a meaningful risk for organizations running Dolibarr for financial operations.
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payroll fields - salary, bonus, hourly rate, daily rate, and weekly hours - for arbitrary user records, bypassing intended payroll-role access controls. All Dolibarr versions before 24.0.0 are affected due to an incomplete field denylist that fails to exclude payroll columns from mass-assignment in the API layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation has been recorded in CISA KEV at the time of analysis, but vendor-released patch version 24.0.0 is available.
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. Publicly available exploit code exists per VulnCheck and codeant.ai research; the vulnerability is not yet listed in CISA KEV but the financial impact potential elevates real-world priority above the 7.1 CVSS score alone suggests.
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any authenticated user holding invoice-deletion rights, regardless of whether they possess payment-issuance rights. All Dolibarr installations prior to version 24.0.0 are affected. Exploitation results in permanent removal of payment records, zeroing of paid invoice amounts, and corruption of accounting exports - a high-integrity, high-availability financial data loss. Publicly available exploit code exists, lowering the attack barrier; active exploitation has not been confirmed by CISA KEV at time of analysis.
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any authenticated user holding third-party creation rights to overwrite the WebPortal password of any company in the system, regardless of ownership. After replacing the password, the attacker can log into the victim company's WebPortal and access its invoice data; the write endpoint also returns the victim's previous password verifier, enabling potential offline credential attacks. A public proof-of-concept is available; no confirmed active exploitation (CISA KEV) at time of analysis, but the low attack complexity and available PoC make this a genuine priority for all pre-24.0.0 deployments.
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. A publicly available proof-of-concept exists; no active exploitation has been confirmed in CISA KEV at the time of analysis.
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-7x63-xv5r-3p2x); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.
Unauthorized operation vulnerabilities in multiple DrayTek VigorSwitch managed switch models allow unauthenticated remote attackers to manipulate device state - including modifying configuration, restarting services, overwriting startup configuration, and clearing audit logs - without any authentication. Affecting at least 28 named VigorSwitch models across the G, P, PQ, Q, and FX series, the root cause is missing authorization checks in multiple syslog-related HTTP handler functions (CWE-862). The CVSS 4.0 score of 8.8 with AV:N/PR:N/UI:N confirms the full attack surface is exposed to any network-reachable attacker, with no public exploit or CISA KEV listing identified at time of analysis.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch exists in WebTop 1.5.7.
Unauthenticated administrator account registration in rConfig 8.0.0 through the affected releases lets any remote attacker create a fully privileged Admin user by hitting a POST /register route that was supposed to be disabled. A duplicate bare Auth::routes() call in routes/web.php re-enables self-registration, and because the registration controller never assigns a role while the users.role column defaults to Admin, the new account is instantly authenticated with full administrative rights. Reported by VulnCheck; no public exploit identified at time of analysis, but the flaw is trivially reachable and grants access to stored device credentials, user data, and API token issuance.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
Improper authorization in TIM Flow before 26.0.6 exposes a privileged dashboard Excel export endpoint to exploitation by any authenticated user, enabling arbitrary SQL query execution against the application database. The missing server-side authorization check (CWE-862) allows non-administrative accounts to craft SQL SELECT statements, submit them to the export endpoint, and receive full query results as a downloadable spreadsheet, effectively granting unrestricted read access to the database. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this immediately actionable by any account holder.
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated low-privileged user modify the application's config/generic.json, tampering with notification, LDAP, SMTP, and general settings. Because the endpoint enforces only that a session exists - with no administrator/privilege check (CWE-862) - a compromised or intentionally low-tier account can redirect integrations, alter authentication-related settings, or knock the installation offline. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; the vendor CVSS 4.0 base score is 9.4.
Authentication bypass in phpIPAM's REST API before 1.8.2 lets unauthenticated remote attackers obtain full API access by abusing an object-cache key collision, then wielding a numeric database row ID as a valid API token to read, write, and delete all IP address management records. VulnCheck reported the flaw and the vendor shipped a fix in 1.8.2; a patch commit is public, so publicly available exploit code exists in the sense of a documented, reproducible technique, though no active exploitation is confirmed. With a CVSS 4.0 base of 9.3 and no authentication or user interaction required, this is a high-priority issue for internet- or network-exposed phpIPAM instances.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets through public notification channels (Rocket.Chat, Mastodon, Bluesky, email) and the public MISP feed, due to incomplete privacy enforcement at the entity level rather than the post level. The post-processing logic in posts.py checked only the individual post's private flag, leaving freshly parsed victims of private groups and markets unprotected because new posts arrive with private=False. A parallel defect in misp_feed.py restricted its privacy check to the group database only, so victims of private markets were admitted to the public MISP feed. No public exploit is identified at time of analysis; this is a passive information-disclosure flaw - subscribers to the affected channels receive the leaked data automatically without taking any active exploitation step.
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the exploitable code paths are visible in public source and trivially reproducible.
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any remote user who can reach the web application to pull records marked private. The legacy /export/<database> route exports selected internal databases without authentication and does not consistently apply the app's private-entity access restrictions, so private groups, markets, and posts can leak. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/group/new endpoint, which lacked Flask-Login's login_required decorator that guards other admin routes. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation requiring no credentials or user interaction. No public exploit identified at time of analysis and no CISA KEV listing, but the trivially low barrier - any attacker who can reach the web interface qualifies - elevates practical risk for publicly exposed instances, with high availability impact (VA:H) suggesting unbounded entry injection could degrade application usability.
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user of one company read, modify, and even hijack supplier records belonging to other companies by sending a PUT to /api/supplier/{id} and supplying an arbitrary company_id in the body. The supplier lookup was not scoped to the caller's tenant and mass-assignment allowed re-parenting a record to the attacker's own company, breaking multi-tenant isolation. A vendor patch exists (5.3.2) and the fix is visible in a public GitHub commit; there is no public exploit identified and it is not on CISA KEV, but the flaw is trivially reproducible from the diff.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
Broken access control in the Notification Master WordPress plugin (versions ≤ 1.7.1) exposes restricted functionality to unauthenticated remote attackers, resulting in high confidentiality impact with no authentication required. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that any network-accessible attacker can trigger the flaw with low complexity, likely exposing sensitive notification configuration data such as subscriber email addresses, phone numbers, or webhook endpoints stored by the plugin. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated information disclosure in KAON PG5298A and PG5298B router firmware exposes the administrative portal password to any attacker on the same local network segment. An adjacent-network attacker can query a specific firmware endpoint without credentials and retrieve sensitive authentication material, enabling full device takeover. Vendor-released patches are available in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The `verify()` VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix.
Cross-client template disclosure in Ghostwriter before 7.1.2 allows authenticated users to exfiltrate proprietary report templates belonging to other clients managed within the same platform instance. The report template swap endpoint failed to enforce ownership validation, accepting user-controlled template primary keys without verifying client-scope alignment. Because template PKs are sequential integers, an attacker with any authenticated access can enumerate foreign template IDs, attach them to their own reports, and trigger report generation to read sensitive client deliverable content - including letterhead, boilerplate legal text, and pentest methodology. No public exploit identified at time of analysis, though VulnCheck has published an advisory and a researcher (geo-chen) has documented the issue in a public repository.
Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled input reintroduce active HTML and JavaScript, resulting in cross-site scripting in consuming web applications. The flaws span URL-sanitization helpers, HTML serialization, Markdown passthrough, and custom policies - most do NOT affect the default sanitize=True path but do affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed in 1.15.0.
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 High rating with C:H/I:H/A:H captures the potential for full kernel-level impact on affected systems.
Race condition in the Linux kernel's ring-buffer subsystem (ring_buffer_swap_cpu()) allows a local low-privileged user to trigger inconsistent kernel buffer state, potentially leading to kernel memory corruption or system crash. The flaw exists because the committing counter used to guard against concurrent buffer swaps transiently drops to zero within rb_move_tail(), opening an interrupt-driven window where a swap can succeed mid-write. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates negligible current exploitation pressure - but the local PR:L attack vector with C:H/I:H/A:H impact makes this significant on multi-tenant Linux systems where tracing interfaces are accessible.
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enumerate arbitrary server-side directories, exposing file system structure without credentials or user interaction. All versions from 1.0.0 through 4.7.1 are affected across the extension's full release history; version 4.7.2 was released to remediate the flaw. No public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis, though the unauthenticated network-accessible nature of the endpoint lowers the bar for opportunistic reconnaissance by automated scanners.
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote attacker to destroy data by issuing a single HTTP GET request to the list.doempty controller action. The endpoint lacks all ACL gates, making exploitation trivially automatable against any publicly accessible Joomla installation running the affected component. No public exploit has been identified at time of analysis, but the absence of any authentication or complexity barrier means the effective exploitation threshold is near zero.
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation path makes it high-priority for Joomla sites running Fabrik.
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, column listings, and the Joomla database table prefix to any remote attacker without credentials. The vulnerable ajax_tables method in the extension's elements model responds to AJAX requests without enforcing access control, violating the principle of least privilege (CWE-284). No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low attack complexity and the high value of schema metadata for downstream attacks.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
Scope and grant-type escalation in the Punk::OAuth2::Server Perl module (through version 0.03) lets a registered OAuth2 client obtain correctly signed at+jwt access tokens carrying scopes and grant types it was never registered for. Because the token endpoint dispatches on the request-body grant_type and passes the requested scope straight to the token minter without checking it against the client's registration, and because authorize copies the query scope into the authorization-code record unchecked, any client can mint over-privileged tokens that a Punk::OAuth2::Checker resource server will accept and honour. There is no public exploit identified at time of analysis and EPSS risk is low (0.20%), but the flaw is authorization-model-breaking and remotely reachable.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Authentication bypass in the SmilePass Selfie Login WordPress plugin (all versions through 1.0.2) lets an unauthenticated attacker log in as any registered account, including administrators. The plugin trusts a client-supplied identity for its selfie-based login flow and performs no server-side verification, so a request simply asserting a target username is accepted. Rated CVSS 9.8; no public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), indicating no widespread automated exploitation observed yet.
Full authentication bypass in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (versions up to and including 1.2.0) lets a remote unauthenticated attacker mint a valid session for any existing user, including administrators. Because one publicly reachable login handler performs no authentication, authorization, or nonce validation, an attacker can take over the site's original admin account in the default configuration without knowing any credentials. EPSS is low (0.19%, 9th percentile) and no public exploit is identified at time of analysis, but the CVSS 9.8 rating reflects trivial, high-impact site takeover.
Authentication bypass in the WP Social Media Login WordPress plugin (versions through 1.0.6) lets unauthenticated attackers log in as any existing user, including administrators, simply by supplying that user's email address. The plugin trusts a claimed social-login identity without verifying that authentication actually completed with the identity provider, so no valid OAuth flow or credentials are needed. Reported by WPScan and rated CVSS 9.8; no public exploit or active exploitation has been identified, and EPSS remains low at 0.15%.
Authentication bypass in the Firebase Authentication WordPress plugin (all versions before 1.7.1) permits unauthenticated remote attackers to impersonate any WordPress account - including administrators - by presenting an unverified Firebase JWT whose email claim matches a WordPress user. The plugin fails to check the `email_verified` field before binding the Firebase identity to a WordPress session, enabling account takeover without knowledge of the target's password. No public exploit is identified at time of analysis and EPSS sits at 0.20% (11th percentile), but the unauthenticated admin takeover potential makes this a high-priority patch for any site running the affected plugin.
Remote administrative account takeover in the ManageWP Worker WordPress plugin (versions before 4.9.37) is possible because login links are neither bound to a specific user account nor invalidated after first use, enabling replay attacks. Any attacker who intercepts or obtains a ManageWP-generated login link - whether it has been previously used or not - can replay it to establish an authenticated session as any WordPress user on the target site, including administrators. No public exploit has been identified at time of analysis, and the vendor-released patch (4.9.37) is available.
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) allows any peer with access to the cluster network to inject or replay MsgReplicateSync messages, silently corrupting replicated telemetry data across all cluster nodes. The CVSS 4.0 score of 8.3 reflects high integrity impact on both the vulnerable system and subsequent cluster peers (VI:H, SI:H) with only low privilege requirements, scoped to cluster-mode deployments. A vendor-released patch is available in version 2026.06.1; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote PHP file execution in Combodo iTop prior to 3.2.3 allows attackers to invoke arbitrary PHP files from the env-production module directory by sending crafted requests to the exec.php dispatcher, which performed no authentication check before routing to module pages. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N), indicating zero-friction network exploitation with no credentials required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing object-level authorization in Combodo iTop prior to 3.2.3 allows authenticated users to retrieve IT management objects outside their permitted access scope via the search interface. The flaw resides in AjaxRenderController::GetDataForTable(), which returned DBObjectSet results without calling UserRights::IsActionAllowed() - confirmed by the fix commit. No public exploit has been identified at time of analysis, but the low-privilege, network-accessible attack path makes this a credible threat for any multi-tenant or role-segmented iTop deployment.
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privilege RoleMember attach to another user's live WebSocket terminal or file-manager session and gain interactive shell access and full file read/write on the monitored target server. The flaw stems from stream UUIDs at GET /ws/terminal/:id and GET /ws/file/:id being validated only for existence, never bound to their creating user, so an attacker who learns a live UUID from access logs, referer headers, browser history, or telemetry breadcrumbs achieves cross-tenant remote code execution. Fixed in v2.0.10; no public exploit identified at time of analysis, though the upstream commit and its regression tests fully disclose the mechanism.
Unauthenticated resource exhaustion in Keystone CMS (Node.js) prior to version 6.5.3 allows any remote GraphQL client to bypass the configured `graphql.maxTake` record-count limit by supplying a negative `take` value, since the comparison `(take ?? Infinity) > maxTake` evaluates to false for negative integers regardless of their magnitude. The bypass applies to both top-level list queries and relationship sub-queries, enabling an attacker to force the server to retrieve an unbounded number of database records and exhaust service resources. No public exploit code has been identified at time of analysis, though the fix and advisory are publicly available.
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low post-enumeration technical barrier makes this a meaningful credential-exposure risk for any internet-facing Craftplan instance.
Unauthenticated remote access to uploaded documents is possible in Combodo iTop versions prior to 3.2.3 due to a missing authentication check in the ajax.document.php endpoint. The commit diff confirms that LoginWebPage::DoLoginEx() was absent from critical code paths that serve uploaded files, allowing any network-reachable user who obtains a valid document URL to download sensitive content without credentials. No public exploit code has been identified at time of analysis, but the attack is technically trivial given the low-complexity, unauthenticated CVSS vector.
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Domain and OAuth-credential hijacking in the Jet Admin no-code internal-tools platform lets a remote attacker create their own malicious app, bind it to a victim's configured custom domain, alter the authentication configuration, and silently reroute the victim's traffic to attacker-controlled logic. Because the takeover also copies the victim's OAuth Client ID and Client Secret into the attacker's workspace, it doubles as a credential-theft primitive against any tenant using an OAuth identity provider. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in Spring AI's tool-calling layer allows a tool that was never advertised to the current request to be dispatched and invoked, which can escalate privileges when the out-of-boundary tool carries greater capabilities than the caller was granted. Affected are Spring AI 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0 (CPE cpe:2.3:a:vmware:spring_ai) in applications that actually use tool calling with a per-request tool list that restricts at least one tool relative to others, and where the attacker can influence the model's input; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (high attack complexity, unauthenticated) rather than the vendor's headline 9.8 AV:N/AC:L score, reflecting that exploitation is conditional ('under certain conditions') and not universally reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is low at 0.17% (7th percentile), and CISA SSVC rates Exploitation as none and Automatable as no, though Technical Impact is total. Realized impact is bounded by the authority of whatever tool slips past the boundary.
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared instance to read financial transaction records belonging to other companies by iterating the integer ID in GET /api/transaction/{id}, which performed no company-scoping and no permission check. Source code analysis of the fix confirms the vulnerable controller called Transaction::find($id) directly against the full dataset, making every transaction on the instance reachable to any valid session. No CISA KEV listing exists and no public exploit code has been identified, though the trivial exploitation pattern (sequential integer enumeration) requires minimal skill.
Cross-user memory disclosure and tampering in Headroom's LLM proxy (versions before 0.36.1) lets a caller read or overwrite any user's stored LLM memory by simply naming another user's identifier in the client-supplied x-headroom-user-id request header. The proxy trusts this header as the authenticated identity across the chat-completion and websocket data-plane paths in headroom/proxy/handlers/openai.py, with nothing binding the value to the actual caller. The console script binds loopback by default, but the shipped docker-compose.yml publishes the proxy on 0.0.0.0 with no required proxy token, so a stock Docker deployment exposes these routes to the network unauthenticated. Reported by VulnCheck; no public exploit identified at time of analysis.
Cross-organization report data exposure in OpenPanel allows any authenticated user to read all analytics reports belonging to another organization's dashboard by supplying a mismatched projectId and dashboardId pair to the report.list tRPC procedure. The enforceAccess middleware validated only project membership, not dashboard ownership, while the underlying getReportsByDashboardId query applied no project-scoping filter - enabling a classic IDOR across tenant boundaries. No public exploit has been identified and no CISA KEV listing exists, but the attack requires only a valid session and knowledge of a foreign dashboardId, making it low-friction in multi-tenant deployments.
Insecure direct object reference in OpenPanel's tRPC report.get procedure exposes any saved report's full configuration to any authenticated instance user. The enforceAccess middleware in packages/trpc/src/trpc.ts conditionally evaluates project membership only when the input carries a projectId or organizationId key; since report.get accepted only a reportId, it bypassed all authorization checks, and the underlying getReportById query performed no project-level scoping. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack pattern is trivially reproducible by any authenticated developer familiar with tRPC.
Unauthenticated remote enumeration of all penetration-testing projects and client organisations is possible in Reconmap due to a misapplied [AllowAnonymous] attribute on the report preview endpoint, overriding the application-wide administrator-role policy. Any unauthenticated caller can issue sequential GET requests to /reports/{id}/preview and receive rendered HTML containing project names, descriptions, and linked client organisation names, addresses, and URLs; 404 responses for missing IDs further confirm which project IDs exist, enabling complete database enumeration. No CISA KEV listing or public exploit code has been identified at time of analysis, but the trivial attack mechanics - sequential HTTP GETs requiring no credentials or tooling - make exploitation highly accessible to any network-adjacent attacker.
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to any authenticated CloudStack user. Affected APIs - deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, updateVirtualMachine, and (from 4.21.0.0) deleteCniConfiguration - fail to validate that the requesting account owns the target userdata resource, enabling one tenant to read, delete, or manipulate another tenant's userdata. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.13% at the 3rd percentile indicates low automated exploitation activity to date, though the multi-tenant cloud infrastructure context makes successful exploitation high-impact for affected operators.
Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating outside their assigned domain scope. Authenticated Domain Admins can create, update, delete, and enumerate project roles and role permissions for projects belonging to entirely unrelated domains, because the authorization check validates only that the caller holds the Domain Admin role without confirming the target project falls within their domain or any subdomain hierarchy. Affected versions span 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0; no public exploit has been identified at time of analysis and EPSS probability is very low at 0.13%.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Execution After Redirect (EAR) in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel enables unauthenticated network attackers to bypass authentication controls and access protected administrative content through version 28072026. The flaw exploits a server-side logic error where HTTP redirect responses intended to gate access to the login page continue executing and rendering protected page content, which an attacker can read before following the redirect. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the risk is primarily elevated by the unauthenticated, low-complexity network vector.
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
Unauthenticated arbitrary file upload in Datiphy Data Management Center v8.3.0 through v8.5.1 exposes the upload API endpoint without any authentication enforcement, permitting remote attackers to write arbitrary files directly to the server's configured upload directory. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by ZUSO ART and registered as ENISA EUVD-2026-63792. The CVSS 4.0 vector scores network-accessible, zero-complexity, unauthenticated exploitation with high integrity and availability impact; no public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection and authentication bypass in Genians Genian NAC (V4.0, V5.0) and ZTNA (V6.0) expose sensitive backend data to remote unauthenticated attackers via crafted data queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites, consistent with the authentication bypass tag. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the unauthenticated, low-complexity nature warrants prompt patching across all three product lines.
Authentication bypass in PTC Windchill Risk and Reliability (WRR) Enterprise Edition allows remote attackers to reach critical functionality without valid credentials, per CVSS 4.0 AV:N/PR:N metrics. The flaw stems from missing authentication (CWE-306) and carries a critical 9.3 score with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.