Authentication Bypass
Monthly
Missing authorization in the Mailu admin REST API allows unauthenticated remote attackers to strip IP-based access restrictions from any existing user token or alter its comment field, effectively neutralizing a key access-control layer on API tokens. All Mailu deployments running versions prior to 2024.06.52 with the admin REST API explicitly enabled are affected. No public exploit code or CISA KEV listing is identified at time of analysis, though the network-accessible, zero-authentication attack vector (PR:N, AC:L) makes this straightforward to leverage when the API is reachable.
Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitrary commands on affected systems. The flaw carries a critical CVSS 9.8 rating (network-reachable, no privileges or user interaction) and, per IBM's own PSIRT advisory, an authentication bypass can lead to full command execution. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network-based attacker to run arbitrary code by bypassing authentication (CWE-287). The CVSS 9.8 rating reflects unauthenticated network exploitation with total confidentiality, integrity, and availability impact, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. IBM has released a fix, and the moderate EPSS score (0.69%, 50th percentile) suggests exploitation is plausible but not yet widespread.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Privilege escalation in Microsoft Azure Arc allows an unauthorized, network-based attacker to bypass authorization checks (CWE-863) and gain elevated privileges over managed hybrid/multicloud resources, with a maximal CVSS 3.1 score of 10.0 driven by a changed scope and high confidentiality/integrity impact. The flaw is reachable remotely without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and because scope is changed, exploitation can affect resources beyond the initially vulnerable component. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.
Privilege elevation in Microsoft Azure Arc allows a remote, unauthenticated attacker to gain elevated privileges over a network by exploiting an incorrectly-resolved name or reference (CWE-706), rated the maximum CVSS 10.0 with a scope change. Reported by Microsoft with a fix available through the MSRC update guide; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Note a source conflict: the CVE description cites Azure Arc while the CPE and tags cite Azure Web Apps, so the exact affected surface should be confirmed with Microsoft.
Remote code execution in Microsoft's Azure Managed Instance for Apache Cassandra allows an unauthenticated network attacker to inject additional command-line arguments (CWE-88) into a backend process and execute arbitrary code, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) that indicates no authentication or user interaction and a scope change beyond the vulnerable component. Microsoft reported the issue and has released a fix through MSRC. No public exploit is identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Sensitive information disclosure affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 via improper authentication (CWE-287), allowing unauthenticated remote attackers to obtain confidential data over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making it trivially reachable from any network-adjacent position. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the automatable SSVC classification means scripted, mass-scanning attacks are plausible once a technique is known.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Session hijacking in BigBlueButton prior to version 3.0.23 enables authenticated meeting participants to impersonate other active attendees by supplying a target's existingUserID to the inadvertently exposed /bigbluebutton/api/handleJoinExistingUser HTTP endpoint. The root cause is a Grails framework visibility error: the handleJoinExistingUser method was declared with def (public, routable) instead of private, making it directly callable over the network without authorization validation - allowing full session reuse without the target's credentials. No CISA KEV listing or public exploit code has been identified, but the low attack complexity and authenticated-participant attack surface make this a credible threat in active BigBlueButton deployments, particularly in education environments where meeting roles carry meaningful trust.
Authentication bypass in Centrifugo real-time messaging server before 6.9.0 lets a remote client spoof trusted proxy headers by populating the client-controlled protocol.ConnectRequest.headers map, which Centrifugo copies and forwards to backend proxies as trusted headers or gRPC metadata. When a backend relies on a header such as x-trusted-user for authentication or authorization, an attacker can impersonate arbitrary users across connect, refresh, subscribe, publish, and RPC proxy calls. Rated CVSS 9.1 (high confidentiality and integrity impact); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in Chrome's Workers implementation allows a remote attacker to bypass the web origin policy and gain unauthorized access to cross-origin data and resources. Exploitation requires a chained attack: the attacker must first compromise the Chrome renderer process through a separate vulnerability, then use social engineering to get the victim to interact with a crafted HTML page. Google has released Chrome 151.0.7922.173 to address this flaw; no public exploit code or active exploitation has been identified at time of analysis, and SSVC signals exploitation:none with a low EPSS of 0.34%.
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Write operations in Laravel Backpack CRUD bypass registered query scopes on Update, Delete, and Reorder paths, enabling any authenticated low-privilege user to modify or delete arbitrary records outside their authorized scope. Versions 6.x before 6.8.14 and 7.x before 7.0.38 of the Composer package backpack/crud are affected when the application uses addBaseClause() or addClause() for row-level access control such as multi-tenancy or per-user data isolation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially guessable nature of sequential primary keys makes cross-tenant record manipulation straightforward for any authenticated session holder.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
TLS hostname verification bypass in Cesanta Mongoose's built-in TLS stack (versions prior to 7.22) lets an on-path attacker holding a wildcard certificate for a parent domain impersonate arbitrarily deep subdomains, defeating certificate validation for clients that use the embedded TLS backend. The flaw stems from mg_match() wildcards crossing DNS label boundaries, so *.example.com wrongly matches foo.bar.example.com. A vendor patch exists in 7.22, but no public exploit identified at time of analysis.
HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. Rated CVSS 9.1; a vendor patch exists (7.22), but no public exploit and no EPSS/KEV data were provided at time of analysis.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the dbx-web backend of the dbx database client (all versions prior to 0.5.51) lets unauthenticated network attackers reach protected API routes. When DBX_PASSWORD is unset and no stored password exists, auth_middleware treats a None password_hash as 'allow everything' and forwards every request to the handler chain, while the service listens on 0.0.0.0:4224 by default. Attackers can invoke /api/connection/connect and /api/query/execute to abuse configured database credentials and run arbitrary SQL. No public exploit has been identified at time of analysis, but the fix is confirmed in release v0.5.51 and the root cause is visible in the published commit.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Unauthenticated remote code execution in OSNEXUS QuantaStor lets network-based attackers run arbitrary code as root by abusing an insecurely configured Kapacitor service that exposes functionality with no authentication check. ZDI (ZDI-26-480, ZDI-CAN-30036) rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.
Insecure direct object reference in WeGIA's employee profile page allows any authenticated low-privileged user to enumerate and retrieve full employee records belonging to other accounts. Affected versions are all WeGIA releases before 3.9.2. Exploitation exposes sensitive PII - including CPF numbers, addresses, contact details, and administrative flags - for every employee record in the system. No public exploit code or active exploitation confirmed at time of analysis; a vendor-released patch is available.
Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.
Authentication bypass in Baylan Smart Meter Management Application (BMS) before v1.1.10.142 lets remote unauthenticated attackers reach a critical function that lacks any authentication check (CWE-306), granting full control over smart-meter management operations. The flaw was reported by Turkey's national CSIRT (TR-CERT/USOM) and carries a CVSS 9.8, reflecting network-reachable, no-privilege access with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Unauthenticated file disclosure in the Frauscher FDS 102 Field Detection System web interface exposes sensitive railway operational data - including full backup archives and configuration files - to any network-reachable attacker via direct HTTP GET requests. The affected endpoints at /FdsBackup.zip and the /downloads/* directory serve files without session validation, a violation of CWE-306 (Missing Authentication for Critical Function). No CISA KEV listing or public exploit has been identified at time of analysis, but the trivial exploitability - no credentials, no complexity, no user interaction - makes this a high-priority exposure for any railway operator with network-accessible FDS 102 deployments.
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
Unauthorized cross-user data access and deletion in Splunk AI Toolkit below 6.0.0 allows any authenticated user holding the 'power' Splunk role to read and destroy experiment history records belonging to other users. The root cause is CWE-639 (IDOR): the toolkit fails to preserve a trusted experiment scope boundary when processing caller-controlled query values, enabling horizontal privilege escalation across all experiment history without touching admin-level permissions. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch (6.0.0) is available per Splunk advisory SVD-2026-0808.
Missing authorization checks across multiple REST API handlers in Splunk AI Toolkit versions below 6.0.0 allow any low-privileged authenticated Splunk user - one who holds neither the 'admin' nor 'power' role - to start, stop, and reconfigure containers and to read or modify sensitive connection and configuration data. The vulnerability stems from CWE-862 (Missing Authorization), where the REST endpoints simply omit role-based access enforcement rather than incorrectly implementing it. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and the fact that it was reported by Cisco make it a credible near-term target.
Privilege escalation in Splunk AI Toolkit before 6.0.0 allows any authenticated low-privileged user to operate with system-level permissions by exploiting a session key substitution flaw in the Agent Run History handler. The handler unconditionally replaces the caller's session key with a system authentication token before executing searches, completely bypassing Splunk's role-based access controls that gate elevated operations behind 'admin' or 'power' roles. This grants unauthorized read access to all indexed data, cross-user search job enumeration and deletion, and write-level system integrity impact - no public exploit has been identified at time of analysis, but the low exploitation complexity and clear mechanism description make this a high-priority patching target for Splunk enterprise deployments.
Remote code execution in Splunk SOAR versions below 8.6.0 allows unauthenticated remote attackers to execute arbitrary code on the SOAR host by exploiting the Automation Broker's blind trust of client-supplied IP address headers. The Automation Broker accepts a forged source-IP header as proof that a notification endpoint request originates from the local system (CWE-290), bypassing all authentication. Successful exploitation grants full confidentiality, integrity, and availability impact on the SOAR host; no public exploit is identified at time of analysis, but the vendor has released a patch in version 8.6.0.
Unauthenticated remote disclosure of Edge Processor pipeline configurations in Splunk Enterprise 10.4.x exposes potentially sensitive data-processing logic to any network-accessible attacker. The REST API endpoint serving Edge Processor configuration lacks authentication controls (CWE-306), meaning any unauthenticated actor can retrieve pipeline details when the Edge Processor feature is enabled. No public exploit code has been identified at time of analysis, and the flaw is restricted to the 10.4.x branch - prior versions are unaffected.
Privilege escalation in Splunk Enterprise allows any authenticated low-privileged user to create or modify scripted lookups through improperly guarded generic transforms configuration endpoints, gaining code execution under the Splunk service account's operating system permissions. Affected versions span four release branches: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. An attacker holding any valid Splunk account - without requiring the 'admin' or 'power' roles - can abuse this to access all Splunk-indexed data and compromise system integrity and availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Splunk Enterprise across multiple supported version branches allows an attacker who has obtained a trusted distributed search private key to forge administrative session tokens entirely over the network. Affected versions span 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. Once a forged token is accepted, the attacker gains full confidentiality, integrity, and availability impact equivalent to an administrator - including access to all indexed data and the ability to disrupt search services. No public exploit or CISA KEV listing exists at time of analysis; this was reported by Cisco, suggesting coordinated disclosure from security research.
Insufficient authorization in Splunk Enterprise's SPL2 module management REST API allows any authenticated low-privileged user - one without the 'admin' or 'power' role - to delete all SPL2 modules across every app and user on the instance. Affected versions are 10.2.x through 10.2.5 and 10.4.x through 10.4.1; versions below 10.2 are unaffected as SPL2 module management did not exist there. The resulting impact is high integrity loss (permanent deletion of exported datasets and functions) and partial service disruption, with no patch-confirmed active exploitation at time of analysis.
SPL injection in Splunk Enterprise exposes all indexed data and compromises search integrity for any low-privileged authenticated user. Specifically, users without the 'admin' or 'power' role can inject Search Processing Language commands into saved-search dispatch requests by supplying malicious time values that Splunk Enterprise fails to validate. Patch versions have been released across all supported branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
SPL injection in Splunk Enterprise's Job Details dashboard enables a low-privileged authenticated attacker to bypass Search Processing Language risky-command safeguards by embedding a malicious search identifier in a crafted dashboard URL and phishing an authenticated victim into opening it. The injected SPL executes under the victim's permissions, potentially exposing all data accessible to that user and compromising search integrity within those bounds. No active exploitation is confirmed and no public exploit code has been identified; a vendor patch is available across all four affected release trains per advisory SVD-2026-0801.
Dashboard Studio in Splunk Enterprise (below versions 9.4.14, 10.0.9, 10.2.6, and 10.4.2) allows a low-privileged 'user'-role account to inject attacker-controlled SPL queries that execute within the authenticated session of a different, potentially higher-privileged victim user. The root cause is Dashboard Studio's failure to consistently enforce app-visibility authorization boundaries before search query options reach the search dispatch layer - a CWE-862 Missing Authorization defect. No public exploit code or active exploitation has been confirmed; a vendor patch is available across all affected branches.
Remote code execution in Splunk Enterprise allows any low-privileged authenticated user to execute arbitrary code by exploiting a missing authorization check in the Federated Search dispatch flow. The vulnerability stems from the platform accepting caller-controlled bundle selection without verifying the fsh_manage capability, meaning any user with basic login access can escalate to full RCE. All four active version branches (9.4.x, 10.0.x, 10.2.x, 10.4.x) are affected below their respective patch thresholds; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Splunk Enterprise allows any authenticated low-privilege user (without admin or power roles) to upload a malicious knowledge bundle via the REST API and force distributed search to execute it across search peers, achieving full C/I/A compromise. The root cause is a missing authorization check - the REST API endpoint for knowledge bundle uploads does not enforce the required edit_dist_peer capability, and distributed search blindly honors caller-supplied bundle selections. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication bar (any valid Splunk account suffices) and network-accessible attack surface make this a high-priority patching target in enterprise environments.
Session material exposure in Splunk Enterprise (versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14) allows an unauthenticated attacker who can view the HTML source of any page that embeds a Splunk report to harvest session credentials and reach the underlying search data with high confidentiality and integrity impact. The flaw stems from the dispatch archive download path failing to enforce the embedded-report authorization boundary, so archived search-job data carries sensitive session material. Rated CVSS 9.4 and reported by Cisco; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) allows a party holding only an embedded report token to download the dispatch archive of an embedded report's search job, exposing session material that grants access to sensitive data and the ability to affect platform integrity. The embedded-report authorization flow fails to block dispatch-archive download requests before the archive begins streaming, so the check is effectively bypassed (CWE-284). No public exploit has been identified at time of analysis, but the 9.4 CVSS score and unauthenticated network vector make this a high-priority patch.
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) lets anyone holding an embedded report token download the underlying search job's dispatch archive over the REST API, recover session material, and impersonate the report owner. Because embedded reports are designed to be shared with unauthenticated viewers, an attacker can read all data the owner can access and, if the owner holds the admin role, perform administrative actions. No public exploit is identified at time of analysis, but the CVSS 9.4 rating and unauthenticated network vector make this high priority.
The Data Model Editor in Splunk Enterprise fails to apply SPL safeguards for risky commands when executing base searches for auto-extracted fields, allowing a low-privileged attacker (non-admin, non-power role) to craft a malicious request that executes arbitrary SPL commands under a victim's authenticated session via browser-based phishing. Affected branches span four active release lines - 9.4.x below 9.4.13, 10.0.x below 10.0.8, 10.2.x below 10.2.6, and 10.4.x below 10.4.1 - confirmed by vendor advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available for all affected branches.
Missing authorization in the Splunk App for Splunk Observability Cloud exposes a stored Observability Cloud access token to any authenticated Splunk user lacking the admin or power role. Affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, and 10.0.9) ship REST API endpoint handlers in the Observability Cloud integration app that fail to enforce the read_o11y_content capability before proxying requests - and the stored token - to Splunk Observability Cloud. Exploitation gives the low-privileged user full read access to all data visible to that token and limited write access to Observability Cloud content. No public exploit or KEV listing has been identified at time of analysis.
Mutual-TLS authentication bypass in the Netty network framework (io.netty.handler.ssl.SslClientHelloHandler) lets an unauthenticated remote attacker reach routes protected only by per-SNI clientAuth=REQUIRE. A ClientHello whose 4-byte handshake header is split across TLS records trips a wrong-offset bounds check, throwing IndexOutOfBoundsException and calling select(ctx, null), which falls back to the default SslContext (clientAuth NONE/OPTIONAL) instead of the SNI-matched context. Fixed in 4.1.137.Final and 4.2.17.Final; no public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.1 (Critical).
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Image policy bypass in IBM Portieris 0.5.0 through 0.14.2 allows remote authenticated attackers to circumvent container image verification controls by exploiting improper authorization of pod owner references (CWE-862). An attacker with low-privilege Kubernetes cluster access can deploy containers from untrusted or unverified images, effectively nullifying the admission controller's entire security enforcement purpose. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM's security advisory.
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, but the fix is straightforward to reverse-engineer from the public patch.
Race condition in the authentication handler (`check.jst`) of RDK-B WebUI rdkb-2025q4-kirkstone allows remote unauthenticated attackers to bypass authentication by submitting concurrent login requests that exploit unsynchronized shared authentication state. Successful exploitation grants full administrative access to the broadband gateway device with high impact across confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.21% (12th percentile) reflects low observed exploitation activity despite the severity of the authentication bypass.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Privilege escalation in XWiki Platform's Live Data Live Table Connector allows any authenticated user with edit access to a page to elevate themselves to script right by sending crafted requests to the Live Data REST API. Script right in XWiki permits execution of arbitrary Velocity code and injection of unfiltered HTML and JavaScript into page content, enabling stored XSS against other users and bypassing extension-level security listeners. The vulnerability spans a wide version range from 13.4-rc-1 through 18.0.x, and no public exploit has been identified at time of analysis.
Unauthenticated remote code execution in ICEcoder 8.1 allows any network-reachable attacker to run arbitrary OS commands as the web-server user by exploiting a three-weakness chain in the terminal endpoint: an authentication bypass triggered by supplying a password parameter, a CSRF skip triggered by any non-empty csrf value, and unsanitized command passthrough directly into PHP's proc_open(). The attack requires a single crafted HTTP POST request and no prior credentials. A public proof-of-concept appears available via a GitHub Gist reference in the VulnCheck advisory. No active exploitation is confirmed by CISA KEV at the time of this analysis.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Improper authorization in the Ceph Monitor subscription handler lets any authenticated CephX user holding only `mon allow r` read the entire config-key (kv) store by sending a single crafted MMonSubscribe message, affecting Ceph releases prior to 20.2.4 (Squid) and 19.2.6 (Reef). Because that store holds OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to reach every host as root, a low-privileged read-only account can escalate to full cluster and host compromise. There is no public exploit identified at time of analysis, though the vendor fix includes a QA reproduction test exercising the kv: subscription path.
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform bulk operations beyond their intended access scope, potentially exposing or modifying financial records belonging to other users or organizational entities within the platform. Discovered and reported by Fluid Attacks, the flaw resides in a shared dispatcher component used across multiple modules of this open-source web-based accounting application. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.2.1.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. All hosted logical partitions are consequently exposed, making this a critical lateral-movement and privilege-escalation path within IBM Power infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insecure direct object reference in Snipe-IT prior to 8.6.3 allows any authenticated low-privilege user to read signed EULA documents belonging to other users by exploiting inconsistent authorization enforcement across two Laravel controllers. The attacker calls /api/v1/users/{target_id}/eulas to learn the target's randomized EULA filename, then retrieves the file via the /account/stored-eula-file/{filename} route, which bypasses the stricter checks enforced by the primary /stored-eula-file/{filename} endpoint. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 8.6.3.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Incorrect authorization in Snipe-IT prior to 8.6.3 allows company-scoped authenticated users operating in FMCS floater mode to cross multi-tenancy boundaries and access, modify, or merge user records associated with no company (null company_id). Affected API endpoints expose cross-tenant personal data and license assignments while bulk edit and merge actions permit unauthorized profile modification and soft-deletion with asset transfer. No public exploit or KEV listing has been identified, but the CVSS 4.0 score of 7.6 reflects the high confidentiality and integrity impact for multi-tenant deployments with floater mode enabled.
Unauthenticated remote attackers can overwrite administrator email addresses and abuse IBM Langflow OSS as an outbound mail relay by exploiting a missing authentication control on the registration endpoint, affecting versions 1.0.0 through 1.10.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivially reachable exploitation with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this viable for opportunistic exploitation once the endpoint is discovered.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Remote unauthenticated code execution in TrueConf Server (versions through 5.3.9, 5.4.9, and 5.5.5) allows a network attacker reachable on port 4307/TCP to invoke an undocumented function and run an arbitrary script without any authentication. Rooted in a missing authentication check (CWE-306) on a critical function, this flaw was disclosed by Kaspersky ICS-CERT and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high remediation priority.
Replay of settled EVM blockchain transaction hashes against ZenHive mpp versions 0.3.0-0.6.2 allows unauthenticated remote attackers to obtain paid resources at no cost. MPP.Methods.EVM.verify/2 validates payment by matching a submitted transaction hash against on-chain token/recipient/amount fields but neither binds the proof to a specific challenge nor records prior use; because MPP.Plug regenerates challenge.id on every 402 response, any historical on-chain transfer visible on a public block explorer can satisfy an unlimited number of subsequent payment challenges on a static-price route. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the attack prerequisites are trivially met given the public nature of blockchain transaction data.
Capture-replay authentication bypass in ZenHive mpp versions 0.6.1-0.6.3 allows unauthenticated network attackers to claim paid resources by reusing a legitimate customer's public TIP-20 TransferWithMemo transaction hash. When the Tempo payment method is configured with a static 'memo' value in method_config, the per-challenge attribution nonce binding that ties a specific transfer to a specific verification challenge is skipped unconditionally, and the hash credential path performs no sender or wallet-signature check - leaving only token, recipient, amount, and the static memo (itself broadcast in every unauthenticated 402 response) to match. No active exploitation is confirmed and no public exploit code has been identified; a vendor patch is available in mpp 0.6.4.
Broken authorization in Flow-Like's Azure presign endpoint allows authenticated app members holding only `ExecuteEvents` permission to obtain Azure Blob Storage SAS tokens with read, write, delete, and list (`sp=rwdl`) access to application content - permissions they explicitly should not possess. Only self-hosted Flow-Like deployments prior to version 1.0.4 using Azure Blob Storage are affected; the vendor's hosted services (Flow-Like Studio and the hosted Web App, both AWS-backed) are explicitly excluded. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the flaw is mechanically straightforward to abuse given that the credential overprovision is a direct API response to a single authenticated request.
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch.
Authentication bypass in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets remote unauthenticated attackers reach a critical function that lacks authentication (CWE-306), yielding full confidentiality, integrity, and availability compromise (CVSS 10.0). The flaw was internally discovered by Cisco during a proactive security hardening review rather than external reporting, and there is no public exploit identified at time of analysis. Because scope is changed (S:C), successful exploitation can extend impact beyond the vulnerable component to other resources it manages.
Privilege escalation in the Grav API Plugin (prior to 1.0.8) allows any authenticated panel user to generate or revoke API keys on behalf of arbitrary accounts, including super-administrators, by exploiting an insufficient authorization check in the apiKeyGenerate and apiKeyRevoke admin task handlers. The plugin enforced only the baseline admin.login permission - held by every panel user - without verifying that the caller had rights over the target account specified in the route parameter, enabling a low-privilege user to mint persistent API credentials carrying the target's full permissions. No public exploit has been identified at time of analysis; the issue is fixed in version 1.0.8.
Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5.
Scope enforcement is entirely absent in the Grav API Plugin prior to 1.0.6, meaning any scoped API key silently exercises its issuing account's full permissions rather than the declared restricted subset. Holders of keys deliberately issued narrow read-only scopes - including third-party integrations and external services - can perform all write, delete, and administrative operations that the key's owning account is authorized for. No public exploit has been identified at time of analysis, but the vulnerability is exploitable by any valid API key holder over the network without user interaction, making supply-chain and insider-threat scenarios the primary risk vectors.
Missing authorization in the Mailu admin REST API allows unauthenticated remote attackers to strip IP-based access restrictions from any existing user token or alter its comment field, effectively neutralizing a key access-control layer on API tokens. All Mailu deployments running versions prior to 2024.06.52 with the admin REST API explicitly enabled are affected. No public exploit code or CISA KEV listing is identified at time of analysis, though the network-accessible, zero-authentication attack vector (PR:N, AC:L) makes this straightforward to leverage when the API is reachable.
Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitrary commands on affected systems. The flaw carries a critical CVSS 9.8 rating (network-reachable, no privileges or user interaction) and, per IBM's own PSIRT advisory, an authentication bypass can lead to full command execution. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network-based attacker to run arbitrary code by bypassing authentication (CWE-287). The CVSS 9.8 rating reflects unauthenticated network exploitation with total confidentiality, integrity, and availability impact, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. IBM has released a fix, and the moderate EPSS score (0.69%, 50th percentile) suggests exploitation is plausible but not yet widespread.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Privilege escalation in Microsoft Azure Arc allows an unauthorized, network-based attacker to bypass authorization checks (CWE-863) and gain elevated privileges over managed hybrid/multicloud resources, with a maximal CVSS 3.1 score of 10.0 driven by a changed scope and high confidentiality/integrity impact. The flaw is reachable remotely without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and because scope is changed, exploitation can affect resources beyond the initially vulnerable component. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.
Privilege elevation in Microsoft Azure Arc allows a remote, unauthenticated attacker to gain elevated privileges over a network by exploiting an incorrectly-resolved name or reference (CWE-706), rated the maximum CVSS 10.0 with a scope change. Reported by Microsoft with a fix available through the MSRC update guide; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Note a source conflict: the CVE description cites Azure Arc while the CPE and tags cite Azure Web Apps, so the exact affected surface should be confirmed with Microsoft.
Remote code execution in Microsoft's Azure Managed Instance for Apache Cassandra allows an unauthenticated network attacker to inject additional command-line arguments (CWE-88) into a backend process and execute arbitrary code, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) that indicates no authentication or user interaction and a scope change beyond the vulnerable component. Microsoft reported the issue and has released a fix through MSRC. No public exploit is identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Sensitive information disclosure affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 via improper authentication (CWE-287), allowing unauthenticated remote attackers to obtain confidential data over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making it trivially reachable from any network-adjacent position. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the automatable SSVC classification means scripted, mass-scanning attacks are plausible once a technique is known.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Session hijacking in BigBlueButton prior to version 3.0.23 enables authenticated meeting participants to impersonate other active attendees by supplying a target's existingUserID to the inadvertently exposed /bigbluebutton/api/handleJoinExistingUser HTTP endpoint. The root cause is a Grails framework visibility error: the handleJoinExistingUser method was declared with def (public, routable) instead of private, making it directly callable over the network without authorization validation - allowing full session reuse without the target's credentials. No CISA KEV listing or public exploit code has been identified, but the low attack complexity and authenticated-participant attack surface make this a credible threat in active BigBlueButton deployments, particularly in education environments where meeting roles carry meaningful trust.
Authentication bypass in Centrifugo real-time messaging server before 6.9.0 lets a remote client spoof trusted proxy headers by populating the client-controlled protocol.ConnectRequest.headers map, which Centrifugo copies and forwards to backend proxies as trusted headers or gRPC metadata. When a backend relies on a header such as x-trusted-user for authentication or authorization, an attacker can impersonate arbitrary users across connect, refresh, subscribe, publish, and RPC proxy calls. Rated CVSS 9.1 (high confidentiality and integrity impact); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in Chrome's Workers implementation allows a remote attacker to bypass the web origin policy and gain unauthorized access to cross-origin data and resources. Exploitation requires a chained attack: the attacker must first compromise the Chrome renderer process through a separate vulnerability, then use social engineering to get the victim to interact with a crafted HTML page. Google has released Chrome 151.0.7922.173 to address this flaw; no public exploit code or active exploitation has been identified at time of analysis, and SSVC signals exploitation:none with a low EPSS of 0.34%.
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Write operations in Laravel Backpack CRUD bypass registered query scopes on Update, Delete, and Reorder paths, enabling any authenticated low-privilege user to modify or delete arbitrary records outside their authorized scope. Versions 6.x before 6.8.14 and 7.x before 7.0.38 of the Composer package backpack/crud are affected when the application uses addBaseClause() or addClause() for row-level access control such as multi-tenancy or per-user data isolation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially guessable nature of sequential primary keys makes cross-tenant record manipulation straightforward for any authenticated session holder.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
TLS hostname verification bypass in Cesanta Mongoose's built-in TLS stack (versions prior to 7.22) lets an on-path attacker holding a wildcard certificate for a parent domain impersonate arbitrarily deep subdomains, defeating certificate validation for clients that use the embedded TLS backend. The flaw stems from mg_match() wildcards crossing DNS label boundaries, so *.example.com wrongly matches foo.bar.example.com. A vendor patch exists in 7.22, but no public exploit identified at time of analysis.
HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. Rated CVSS 9.1; a vendor patch exists (7.22), but no public exploit and no EPSS/KEV data were provided at time of analysis.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the dbx-web backend of the dbx database client (all versions prior to 0.5.51) lets unauthenticated network attackers reach protected API routes. When DBX_PASSWORD is unset and no stored password exists, auth_middleware treats a None password_hash as 'allow everything' and forwards every request to the handler chain, while the service listens on 0.0.0.0:4224 by default. Attackers can invoke /api/connection/connect and /api/query/execute to abuse configured database credentials and run arbitrary SQL. No public exploit has been identified at time of analysis, but the fix is confirmed in release v0.5.51 and the root cause is visible in the published commit.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Unauthenticated remote code execution in OSNEXUS QuantaStor lets network-based attackers run arbitrary code as root by abusing an insecurely configured Kapacitor service that exposes functionality with no authentication check. ZDI (ZDI-26-480, ZDI-CAN-30036) rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.
Insecure direct object reference in WeGIA's employee profile page allows any authenticated low-privileged user to enumerate and retrieve full employee records belonging to other accounts. Affected versions are all WeGIA releases before 3.9.2. Exploitation exposes sensitive PII - including CPF numbers, addresses, contact details, and administrative flags - for every employee record in the system. No public exploit code or active exploitation confirmed at time of analysis; a vendor-released patch is available.
Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.
Authentication bypass in Baylan Smart Meter Management Application (BMS) before v1.1.10.142 lets remote unauthenticated attackers reach a critical function that lacks any authentication check (CWE-306), granting full control over smart-meter management operations. The flaw was reported by Turkey's national CSIRT (TR-CERT/USOM) and carries a CVSS 9.8, reflecting network-reachable, no-privilege access with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Unauthenticated file disclosure in the Frauscher FDS 102 Field Detection System web interface exposes sensitive railway operational data - including full backup archives and configuration files - to any network-reachable attacker via direct HTTP GET requests. The affected endpoints at /FdsBackup.zip and the /downloads/* directory serve files without session validation, a violation of CWE-306 (Missing Authentication for Critical Function). No CISA KEV listing or public exploit has been identified at time of analysis, but the trivial exploitability - no credentials, no complexity, no user interaction - makes this a high-priority exposure for any railway operator with network-accessible FDS 102 deployments.
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
Unauthorized cross-user data access and deletion in Splunk AI Toolkit below 6.0.0 allows any authenticated user holding the 'power' Splunk role to read and destroy experiment history records belonging to other users. The root cause is CWE-639 (IDOR): the toolkit fails to preserve a trusted experiment scope boundary when processing caller-controlled query values, enabling horizontal privilege escalation across all experiment history without touching admin-level permissions. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch (6.0.0) is available per Splunk advisory SVD-2026-0808.
Missing authorization checks across multiple REST API handlers in Splunk AI Toolkit versions below 6.0.0 allow any low-privileged authenticated Splunk user - one who holds neither the 'admin' nor 'power' role - to start, stop, and reconfigure containers and to read or modify sensitive connection and configuration data. The vulnerability stems from CWE-862 (Missing Authorization), where the REST endpoints simply omit role-based access enforcement rather than incorrectly implementing it. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and the fact that it was reported by Cisco make it a credible near-term target.
Privilege escalation in Splunk AI Toolkit before 6.0.0 allows any authenticated low-privileged user to operate with system-level permissions by exploiting a session key substitution flaw in the Agent Run History handler. The handler unconditionally replaces the caller's session key with a system authentication token before executing searches, completely bypassing Splunk's role-based access controls that gate elevated operations behind 'admin' or 'power' roles. This grants unauthorized read access to all indexed data, cross-user search job enumeration and deletion, and write-level system integrity impact - no public exploit has been identified at time of analysis, but the low exploitation complexity and clear mechanism description make this a high-priority patching target for Splunk enterprise deployments.
Remote code execution in Splunk SOAR versions below 8.6.0 allows unauthenticated remote attackers to execute arbitrary code on the SOAR host by exploiting the Automation Broker's blind trust of client-supplied IP address headers. The Automation Broker accepts a forged source-IP header as proof that a notification endpoint request originates from the local system (CWE-290), bypassing all authentication. Successful exploitation grants full confidentiality, integrity, and availability impact on the SOAR host; no public exploit is identified at time of analysis, but the vendor has released a patch in version 8.6.0.
Unauthenticated remote disclosure of Edge Processor pipeline configurations in Splunk Enterprise 10.4.x exposes potentially sensitive data-processing logic to any network-accessible attacker. The REST API endpoint serving Edge Processor configuration lacks authentication controls (CWE-306), meaning any unauthenticated actor can retrieve pipeline details when the Edge Processor feature is enabled. No public exploit code has been identified at time of analysis, and the flaw is restricted to the 10.4.x branch - prior versions are unaffected.
Privilege escalation in Splunk Enterprise allows any authenticated low-privileged user to create or modify scripted lookups through improperly guarded generic transforms configuration endpoints, gaining code execution under the Splunk service account's operating system permissions. Affected versions span four release branches: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. An attacker holding any valid Splunk account - without requiring the 'admin' or 'power' roles - can abuse this to access all Splunk-indexed data and compromise system integrity and availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Splunk Enterprise across multiple supported version branches allows an attacker who has obtained a trusted distributed search private key to forge administrative session tokens entirely over the network. Affected versions span 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. Once a forged token is accepted, the attacker gains full confidentiality, integrity, and availability impact equivalent to an administrator - including access to all indexed data and the ability to disrupt search services. No public exploit or CISA KEV listing exists at time of analysis; this was reported by Cisco, suggesting coordinated disclosure from security research.
Insufficient authorization in Splunk Enterprise's SPL2 module management REST API allows any authenticated low-privileged user - one without the 'admin' or 'power' role - to delete all SPL2 modules across every app and user on the instance. Affected versions are 10.2.x through 10.2.5 and 10.4.x through 10.4.1; versions below 10.2 are unaffected as SPL2 module management did not exist there. The resulting impact is high integrity loss (permanent deletion of exported datasets and functions) and partial service disruption, with no patch-confirmed active exploitation at time of analysis.
SPL injection in Splunk Enterprise exposes all indexed data and compromises search integrity for any low-privileged authenticated user. Specifically, users without the 'admin' or 'power' role can inject Search Processing Language commands into saved-search dispatch requests by supplying malicious time values that Splunk Enterprise fails to validate. Patch versions have been released across all supported branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
SPL injection in Splunk Enterprise's Job Details dashboard enables a low-privileged authenticated attacker to bypass Search Processing Language risky-command safeguards by embedding a malicious search identifier in a crafted dashboard URL and phishing an authenticated victim into opening it. The injected SPL executes under the victim's permissions, potentially exposing all data accessible to that user and compromising search integrity within those bounds. No active exploitation is confirmed and no public exploit code has been identified; a vendor patch is available across all four affected release trains per advisory SVD-2026-0801.
Dashboard Studio in Splunk Enterprise (below versions 9.4.14, 10.0.9, 10.2.6, and 10.4.2) allows a low-privileged 'user'-role account to inject attacker-controlled SPL queries that execute within the authenticated session of a different, potentially higher-privileged victim user. The root cause is Dashboard Studio's failure to consistently enforce app-visibility authorization boundaries before search query options reach the search dispatch layer - a CWE-862 Missing Authorization defect. No public exploit code or active exploitation has been confirmed; a vendor patch is available across all affected branches.
Remote code execution in Splunk Enterprise allows any low-privileged authenticated user to execute arbitrary code by exploiting a missing authorization check in the Federated Search dispatch flow. The vulnerability stems from the platform accepting caller-controlled bundle selection without verifying the fsh_manage capability, meaning any user with basic login access can escalate to full RCE. All four active version branches (9.4.x, 10.0.x, 10.2.x, 10.4.x) are affected below their respective patch thresholds; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Splunk Enterprise allows any authenticated low-privilege user (without admin or power roles) to upload a malicious knowledge bundle via the REST API and force distributed search to execute it across search peers, achieving full C/I/A compromise. The root cause is a missing authorization check - the REST API endpoint for knowledge bundle uploads does not enforce the required edit_dist_peer capability, and distributed search blindly honors caller-supplied bundle selections. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication bar (any valid Splunk account suffices) and network-accessible attack surface make this a high-priority patching target in enterprise environments.
Session material exposure in Splunk Enterprise (versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14) allows an unauthenticated attacker who can view the HTML source of any page that embeds a Splunk report to harvest session credentials and reach the underlying search data with high confidentiality and integrity impact. The flaw stems from the dispatch archive download path failing to enforce the embedded-report authorization boundary, so archived search-job data carries sensitive session material. Rated CVSS 9.4 and reported by Cisco; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) allows a party holding only an embedded report token to download the dispatch archive of an embedded report's search job, exposing session material that grants access to sensitive data and the ability to affect platform integrity. The embedded-report authorization flow fails to block dispatch-archive download requests before the archive begins streaming, so the check is effectively bypassed (CWE-284). No public exploit has been identified at time of analysis, but the 9.4 CVSS score and unauthenticated network vector make this a high-priority patch.
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) lets anyone holding an embedded report token download the underlying search job's dispatch archive over the REST API, recover session material, and impersonate the report owner. Because embedded reports are designed to be shared with unauthenticated viewers, an attacker can read all data the owner can access and, if the owner holds the admin role, perform administrative actions. No public exploit is identified at time of analysis, but the CVSS 9.4 rating and unauthenticated network vector make this high priority.
The Data Model Editor in Splunk Enterprise fails to apply SPL safeguards for risky commands when executing base searches for auto-extracted fields, allowing a low-privileged attacker (non-admin, non-power role) to craft a malicious request that executes arbitrary SPL commands under a victim's authenticated session via browser-based phishing. Affected branches span four active release lines - 9.4.x below 9.4.13, 10.0.x below 10.0.8, 10.2.x below 10.2.6, and 10.4.x below 10.4.1 - confirmed by vendor advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available for all affected branches.
Missing authorization in the Splunk App for Splunk Observability Cloud exposes a stored Observability Cloud access token to any authenticated Splunk user lacking the admin or power role. Affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, and 10.0.9) ship REST API endpoint handlers in the Observability Cloud integration app that fail to enforce the read_o11y_content capability before proxying requests - and the stored token - to Splunk Observability Cloud. Exploitation gives the low-privileged user full read access to all data visible to that token and limited write access to Observability Cloud content. No public exploit or KEV listing has been identified at time of analysis.
Mutual-TLS authentication bypass in the Netty network framework (io.netty.handler.ssl.SslClientHelloHandler) lets an unauthenticated remote attacker reach routes protected only by per-SNI clientAuth=REQUIRE. A ClientHello whose 4-byte handshake header is split across TLS records trips a wrong-offset bounds check, throwing IndexOutOfBoundsException and calling select(ctx, null), which falls back to the default SslContext (clientAuth NONE/OPTIONAL) instead of the SNI-matched context. Fixed in 4.1.137.Final and 4.2.17.Final; no public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.1 (Critical).
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Image policy bypass in IBM Portieris 0.5.0 through 0.14.2 allows remote authenticated attackers to circumvent container image verification controls by exploiting improper authorization of pod owner references (CWE-862). An attacker with low-privilege Kubernetes cluster access can deploy containers from untrusted or unverified images, effectively nullifying the admission controller's entire security enforcement purpose. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM's security advisory.
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, but the fix is straightforward to reverse-engineer from the public patch.
Race condition in the authentication handler (`check.jst`) of RDK-B WebUI rdkb-2025q4-kirkstone allows remote unauthenticated attackers to bypass authentication by submitting concurrent login requests that exploit unsynchronized shared authentication state. Successful exploitation grants full administrative access to the broadband gateway device with high impact across confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.21% (12th percentile) reflects low observed exploitation activity despite the severity of the authentication bypass.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Privilege escalation in XWiki Platform's Live Data Live Table Connector allows any authenticated user with edit access to a page to elevate themselves to script right by sending crafted requests to the Live Data REST API. Script right in XWiki permits execution of arbitrary Velocity code and injection of unfiltered HTML and JavaScript into page content, enabling stored XSS against other users and bypassing extension-level security listeners. The vulnerability spans a wide version range from 13.4-rc-1 through 18.0.x, and no public exploit has been identified at time of analysis.
Unauthenticated remote code execution in ICEcoder 8.1 allows any network-reachable attacker to run arbitrary OS commands as the web-server user by exploiting a three-weakness chain in the terminal endpoint: an authentication bypass triggered by supplying a password parameter, a CSRF skip triggered by any non-empty csrf value, and unsanitized command passthrough directly into PHP's proc_open(). The attack requires a single crafted HTTP POST request and no prior credentials. A public proof-of-concept appears available via a GitHub Gist reference in the VulnCheck advisory. No active exploitation is confirmed by CISA KEV at the time of this analysis.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Improper authorization in the Ceph Monitor subscription handler lets any authenticated CephX user holding only `mon allow r` read the entire config-key (kv) store by sending a single crafted MMonSubscribe message, affecting Ceph releases prior to 20.2.4 (Squid) and 19.2.6 (Reef). Because that store holds OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to reach every host as root, a low-privileged read-only account can escalate to full cluster and host compromise. There is no public exploit identified at time of analysis, though the vendor fix includes a QA reproduction test exercising the kv: subscription path.
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform bulk operations beyond their intended access scope, potentially exposing or modifying financial records belonging to other users or organizational entities within the platform. Discovered and reported by Fluid Attacks, the flaw resides in a shared dispatcher component used across multiple modules of this open-source web-based accounting application. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.2.1.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. All hosted logical partitions are consequently exposed, making this a critical lateral-movement and privilege-escalation path within IBM Power infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insecure direct object reference in Snipe-IT prior to 8.6.3 allows any authenticated low-privilege user to read signed EULA documents belonging to other users by exploiting inconsistent authorization enforcement across two Laravel controllers. The attacker calls /api/v1/users/{target_id}/eulas to learn the target's randomized EULA filename, then retrieves the file via the /account/stored-eula-file/{filename} route, which bypasses the stricter checks enforced by the primary /stored-eula-file/{filename} endpoint. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 8.6.3.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Incorrect authorization in Snipe-IT prior to 8.6.3 allows company-scoped authenticated users operating in FMCS floater mode to cross multi-tenancy boundaries and access, modify, or merge user records associated with no company (null company_id). Affected API endpoints expose cross-tenant personal data and license assignments while bulk edit and merge actions permit unauthorized profile modification and soft-deletion with asset transfer. No public exploit or KEV listing has been identified, but the CVSS 4.0 score of 7.6 reflects the high confidentiality and integrity impact for multi-tenant deployments with floater mode enabled.
Unauthenticated remote attackers can overwrite administrator email addresses and abuse IBM Langflow OSS as an outbound mail relay by exploiting a missing authentication control on the registration endpoint, affecting versions 1.0.0 through 1.10.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivially reachable exploitation with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this viable for opportunistic exploitation once the endpoint is discovered.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Remote unauthenticated code execution in TrueConf Server (versions through 5.3.9, 5.4.9, and 5.5.5) allows a network attacker reachable on port 4307/TCP to invoke an undocumented function and run an arbitrary script without any authentication. Rooted in a missing authentication check (CWE-306) on a critical function, this flaw was disclosed by Kaspersky ICS-CERT and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high remediation priority.
Replay of settled EVM blockchain transaction hashes against ZenHive mpp versions 0.3.0-0.6.2 allows unauthenticated remote attackers to obtain paid resources at no cost. MPP.Methods.EVM.verify/2 validates payment by matching a submitted transaction hash against on-chain token/recipient/amount fields but neither binds the proof to a specific challenge nor records prior use; because MPP.Plug regenerates challenge.id on every 402 response, any historical on-chain transfer visible on a public block explorer can satisfy an unlimited number of subsequent payment challenges on a static-price route. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the attack prerequisites are trivially met given the public nature of blockchain transaction data.
Capture-replay authentication bypass in ZenHive mpp versions 0.6.1-0.6.3 allows unauthenticated network attackers to claim paid resources by reusing a legitimate customer's public TIP-20 TransferWithMemo transaction hash. When the Tempo payment method is configured with a static 'memo' value in method_config, the per-challenge attribution nonce binding that ties a specific transfer to a specific verification challenge is skipped unconditionally, and the hash credential path performs no sender or wallet-signature check - leaving only token, recipient, amount, and the static memo (itself broadcast in every unauthenticated 402 response) to match. No active exploitation is confirmed and no public exploit code has been identified; a vendor patch is available in mpp 0.6.4.
Broken authorization in Flow-Like's Azure presign endpoint allows authenticated app members holding only `ExecuteEvents` permission to obtain Azure Blob Storage SAS tokens with read, write, delete, and list (`sp=rwdl`) access to application content - permissions they explicitly should not possess. Only self-hosted Flow-Like deployments prior to version 1.0.4 using Azure Blob Storage are affected; the vendor's hosted services (Flow-Like Studio and the hosted Web App, both AWS-backed) are explicitly excluded. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the flaw is mechanically straightforward to abuse given that the credential overprovision is a direct API response to a single authenticated request.
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch.
Authentication bypass in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets remote unauthenticated attackers reach a critical function that lacks authentication (CWE-306), yielding full confidentiality, integrity, and availability compromise (CVSS 10.0). The flaw was internally discovered by Cisco during a proactive security hardening review rather than external reporting, and there is no public exploit identified at time of analysis. Because scope is changed (S:C), successful exploitation can extend impact beyond the vulnerable component to other resources it manages.
Privilege escalation in the Grav API Plugin (prior to 1.0.8) allows any authenticated panel user to generate or revoke API keys on behalf of arbitrary accounts, including super-administrators, by exploiting an insufficient authorization check in the apiKeyGenerate and apiKeyRevoke admin task handlers. The plugin enforced only the baseline admin.login permission - held by every panel user - without verifying that the caller had rights over the target account specified in the route parameter, enabling a low-privilege user to mint persistent API credentials carrying the target's full permissions. No public exploit has been identified at time of analysis; the issue is fixed in version 1.0.8.
Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5.
Scope enforcement is entirely absent in the Grav API Plugin prior to 1.0.6, meaning any scoped API key silently exercises its issuing account's full permissions rather than the declared restricted subset. Holders of keys deliberately issued narrow read-only scopes - including third-party integrations and external services - can perform all write, delete, and administrative operations that the key's owning account is authorized for. No public exploit has been identified at time of analysis, but the vulnerability is exploitable by any valid API key holder over the network without user interaction, making supply-chain and insider-threat scenarios the primary risk vectors.