Authentication Bypass
Monthly
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers with no credentials to access confidential ERP data across a scope boundary. Carrying a CVSS 3.1 score of 8.6 with Scope Changed and High Confidentiality impact, the flaw exposes the underlying Priority ERP backend through the portal layer - meaning business-critical records such as financial data, customer information, or operational records may be readable without any authentication. No public exploit code and no CISA KEV listing exist at time of analysis, but the attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation requires minimal sophistication from any network position.
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote unauthenticated attackers reach protected portal functionality and, because of a scope change, the underlying ERP data it fronts. The maximum CVSS 10.0 rating reflects network reach, no privileges, and high confidentiality and integrity impact. Reported to Israel's INCD; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
WP Helper Premium WordPress plugin before 4.7.6 exposes WooCommerce order data to unauthenticated network attackers via a missing order key authorization check on its custom order confirmation page and related AJAX handlers. Any unauthenticated user can enumerate order IDs to read other customers' personally identifiable information and arbitrarily change the state of any order. No public exploit has been identified at time of analysis, though the SSVC framework rates this as automatable, meaning scripted mass enumeration is technically feasible once the vulnerable module is enabled.
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.
Watch API authorization bypass in etcd allows any authenticated low-privilege user to silently read the entire keyspace beyond their granted key. A user holding a READ grant on a single exact key can invoke the Watch gRPC API with clientv3.WithFromKey() to receive streaming events for every key lexicographically greater than or equal to their permitted key - an unbounded confidentiality breach against etcd's RBAC model. Affected versions span etcd prior to 3.5.33, 3.6.0-3.6.13, and 3.7.0 pre-releases; fixes are released as 3.5.33, 3.6.14, and 3.7.1. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploit path (a single standard gRPC flag) makes weaponization straightforward for any attacker with valid credentials.
Remote unauthenticated authentication bypass in WolfStack before 25.9.2 lets attackers fully compromise container hosts by supplying a hard-coded cluster secret in the X-WolfStack-Secret header. Because the secret is a compile-time constant published in src/auth/mod.rs, anyone who can reach a node's management port passes the require_auth() gate with no session, API key, or account, and can then enumerate every Docker/LXC container and run arbitrary commands as root inside any of them. No public exploit is identified at time of analysis, but the flaw is trivially reproducible from source and was reported by VulnCheck.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.44 lets any authenticated member of a coordination case retrieve coordinator-uploaded attachments that were never marked as shared. The type=track download branch checks only case membership (_is_my_case) and omits the VinceTrackAttachment.shared gate, so a vendor on a case who knows or is sent an artefact's UUID can pull not-yet-released coordinator material. EPSS is low (0.15%, 4th percentile) and no public exploit is identified; this is a logic/authorization defect fixed upstream in PR #235.
Local privilege escalation in IBM Informix Dynamic Server 14.10 and 15.0 allows any low-privileged local OS user to gain root access by exploiting improper access controls in the setuid-root `oninit` utility. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms a low-complexity local attack requiring no user interaction, resulting in full system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a specially crafted query that bypasses authorization controls and gains elevated database privileges, classified as CWE-285 improper authorization. IBM reported the issue and has published a fix; there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low at 0.32% (25th percentile) despite the 9.8 CVSS, indicating no observed mass-exploitation activity yet.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauthenticated remote attackers via inconsistent HTTP request parsing at the reverse proxy layer. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (software and container variants). No public exploit or CISA KEV listing has been identified at time of analysis, but the identity gateway role of this product means a successful bypass could silently undermine authentication enforcement across all downstream resources it protects.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privilege instance configurations into restricted projects. When an instance is migrated to a target project, LXD applies caller-supplied configuration overrides without re-validating them against the destination project's enforced restrictions, so security controls such as privileged-container or device limits can be defeated. Rated CVSS 9.9 (CWE-863) with a scope-changing impact; no public exploit has been identified at time of analysis.
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallowed high-privilege configurations into restricted projects, defeating per-project security controls. The root cause is a time-of-check to time-of-use race in which LXD validates project restrictions before configuration merging finishes during cross-project instance copies. Rated CVSS 9.9 with a scope change; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass via spoofing in Dell Display and Peripheral Manager (DDPM) for Windows, versions prior to 2.3.0.17, enables local low-privileged attackers to escalate their privileges and execute arbitrary code on affected systems. The flaw (CWE-290) allows an attacker already present on the system to spoof an authenticated identity, circumventing DDPM's internal access controls. Dell has released a patched version (2.3.0.17) via advisory DSA-2026-320; no public exploit or CISA KEV listing has been identified at time of analysis.
Elevation of privilege and arbitrary code execution in Dell Display and Peripheral Manager (DDPM) for Windows, all versions prior to 2.3.0.17, is achievable by a low-privileged local attacker exploiting an authentication bypass by spoofing flaw. The CWE-284 root cause - improper access control - allows the attacker to circumvent DDPM's privilege verification, resulting in full confidentiality, integrity, and availability compromise on the affected host. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; Dell has released the corrective patch in version 2.3.0.17 via advisory DSA-2026-320.
Elevation of privilege and arbitrary code execution in Dell Display and Peripheral Manager (DDPM) for Windows allows a low-privileged local attacker on affected systems to bypass access controls and run code at a higher privilege level. All DDPM versions prior to 2.3.0.17 are affected, as confirmed by Dell advisory DSA-2026-320. No public exploit code or CISA KEV listing has been identified at time of analysis, though tags indicate RCE and authentication bypass primitives are involved, consistent with the CWE-284 root cause.
Local privilege escalation in Dell Display and Peripheral Manager (DDPM) for Windows enables a low-privileged local attacker to bypass access controls and execute arbitrary code at elevated privileges, affecting all versions prior to 2.3.0.17. The root cause is an improper access control flaw classified as CWE-290 (Authentication Bypass by Capture-replay), through which a standard user account can subvert DDPM's privileged service process and achieve system-level code execution. Dell has released version 2.3.0.17 via advisory DSA-2026-320, and no public exploit or active exploitation has been identified at time of analysis.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated user smuggle disallowed instance configurations into a restricted project by triggering a cross-project, cross-cluster-member migration. Because the migration arrives at the destination node as an internal cluster notification, the destination skips all target-project restriction checks (CWE-863), so limits and security restrictions on the target project are not enforced. Rated CVSS 9.9; reported by Canonical with a vendor patch available, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privileged remote code execution in ScadaLTS 2.7.8.1 lets any authenticated user - including accounts holding only low-privilege, read-only permissions - invoke a server-side method that performs no authorization check and run arbitrary OS commands. Because the ScadaLTS server process runs as root, a successful call yields full compromise of the underlying host, turning a low-value SCADA login into total system takeover. Reported by Tenable (TRA-2026-55); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted project escape that project's security policy by migrating an instance into it. Because instancePostMigration never re-validated the incoming instance against the target project's enforced restrictions, an attacker could build a high-privilege or otherwise disallowed instance inside an unrestricted project and relocate it into the restricted one, inheriting capabilities (low-level container access, arbitrary devices, unrestricted network access) that the project was configured to forbid. Rated CVSS 9.9 by the vendor; no public exploit identified at time of analysis and it is not in CISA KEV.
Authentication bypass in SiYuan's kernel CheckAuth function unconditionally grants administrator privileges (RoleAdministrator) to any HTTP request whose RemoteAddr is 127.0.0.1, affecting a specific set of endpoints including /api/system/exit, /assets/*, and /export/*, even when an access auth code is explicitly configured. All versions up to and including v3.7.2 are affected; v3.7.4 contains the vendor-released patch. The fixed-port reverse proxy forwards requests to the kernel over loopback without injecting authentication tokens or configuring trusted proxy headers, creating a theoretical remote unauthenticated attack path if the proxy is bound to a network-accessible interface - though per the advisory this remote scenario was established only by code inspection and was not reproduced end-to-end. No public exploit code exists and this CVE is not listed in the CISA KEV catalog.
Sensitive data disclosure in SiYuan note-taking application before v3.7.4 lets anonymous readers of a published workspace pull Relation and Rollup cell contents out of hidden or password-protected databases. Because renderAttributeView does not re-check authorization on the related database, an unauthenticated visitor can request a published attribute view that references a restricted database and read its protected values, and can bypass row-level filtering entirely when the first column is a non-block type. Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis.
Unauthorized cross-document content disclosure in SiYuan note-taking software before v3.7.4 allows remote attackers to read protected notes without credentials. The getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints resolve embed queries inside published blocks without re-checking publish-access controls, so an attacker who reaches a published SiYuan workspace can pull back content from password-protected, hidden, or forbidden documents. No public exploit identified at time of analysis, but VulnCheck rates it CVSS 9.2 (CVSS 4.0) and it constitutes an authentication/authorization bypass.
Anonymous information disclosure in SiYuan before v3.7.4 lets unauthenticated remote readers retrieve fully decrypted content from encrypted notebooks. Because the publish API treats encrypted notebooks as publicly accessible by default, any anonymous visitor can enumerate and read documents from an unlocked encrypted notebook without authentication or knowledge of the encryption key. Reported by VulnCheck and rated CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Improper authorization in Craft CMS 5.0.0-RC1 through 5.10.7 exposes the generic `elements/save` action to silent password manipulation, enabling any authenticated control panel user to reset their own password without confirming their current credentials. More critically, attackers holding the `edit users` permission can silently overwrite passwords for any account on the platform-including administrator accounts-achieving full administrative takeover without requiring the legitimately guarded `Administrate users` privilege. A vendor-released patch exists in version 5.10.8, and no public exploit code is identified at time of analysis, though the GHSA advisory's detailed technical description materially lowers the bar for independent exploitation.
Privilege escalation in GitLab Enterprise Edition exposes project governance controls to any authenticated project member due to missing authorization checks on the project update API endpoint. Affecting EE versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1, this flaw lets lower-privileged users (developers, reporters) silently overwrite project settings normally restricted to maintainers or owners - including branch protection rules, merge approval requirements, and access policies. A publicly available exploit exists via HackerOne; active exploitation is not confirmed by CISA KEV, but the low attack complexity combined with public proof-of-concept code significantly elevates operational urgency.
Improper authorization of namespace identity in GitLab Enterprise Edition 19.1.x and 19.2.x allows an authenticated low-privilege user to attribute AI feature usage to arbitrary namespaces they do not own, crossing organizational authorization boundaries within a multi-tenant deployment. The flaw, classified as CWE-639, arises because user-supplied identity information in requests is insufficiently validated before being used to authorize namespace-scoped AI operations, producing a scope change that affects namespaces beyond the attacker's own. GitLab has released patches in versions 19.1.4 and 19.2.2, and no public exploit code exists at time of analysis.
Full account takeover is possible in Budibase's account portal via an Insecure Direct Object Reference (IDOR) in the email-change API endpoint, affecting all versions prior to 3.40.0. POST /api/v2/email on account.budibase.app accepts a client-supplied accountId without binding it to the authenticated session - an authenticated attacker who obtains a victim's accountId UUID can redirect the email-change verification code to an attacker-controlled address, then complete a password reset to seize the victim's account entirely without any victim interaction required. No public exploit code has been identified at time of analysis; the vulnerability is fixed in Budibase 3.40.0.
Improper authorization in GitLab CE/EE pipeline reference validation allows authenticated developer-role users to execute CI/CD pipelines on protected branches they lack push permissions to access, effectively bypassing branch protection policies. All GitLab versions from 19.0 through 19.2 are affected until the respective patch releases. A publicly available exploit exists via HackerOne report #3832069, though no confirmed active exploitation has been recorded in the CISA KEV catalog at time of analysis.
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.
Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
Security restriction bypass in IBM i 7.3 through 7.6 enables remote authenticated attackers to elevate privileges via unsafe Java reflection (CWE-915), allowing dynamic modification of object attributes in ways the platform's access control layer does not anticipate. The CVSS 8.3 score reflects network reachability, low attack complexity, and high confidentiality and integrity impact - meaning any valid low-privilege account can exploit this without user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low barrier to exploitation (PR:L, AC:L) makes this a credible lateral-movement or privilege-escalation path in IBM i shops.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an ADB-connected Android device before version 3.0.8. The create_mobile_data_collection_server and create_mobile_action_server components bind Streamable HTTP MCP services to TCP 8020 and 8021 with no credential check, exposing tools such as capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control to anyone who can reach the ports. No public exploit identified at time of analysis, but the fix (adding UFO_MCP_API_KEY bearer auth) is confirmed in the vendor advisory GHSA-24fq-m9rr-g3mm and release v3.0.8, and the high EPSS-relevant impact (CVSS 9.4) makes this a serious exposure wherever the mobile agent is run on a reachable interface.
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Progress Software WhatsUp Gold (all versions before 2026.0.2) allows unauthenticated attackers with adjacent network access to invoke a critical function exposed without authentication (CWE-306), executing arbitrary code as the IIS application service account. The CVSS 3.1 score of 8.8 with PR:N and UI:N confirms zero-credential, zero-interaction exploitation against all pre-patch deployments. No public exploit has been identified at time of analysis, but a vendor patch is available in version 2026.0.2 per the August 2026 security bulletin.
Insufficient input validation on the `_handler` POST field in Winter CMS's form postback mechanism allows any authenticated backend user to invoke arbitrary controller methods-including protected and private ones-bypassing role-based permission checks. The Users controller compounded this by conditionally nullifying its `$requiredPermissions` for the `myaccount` action, enabling low-privilege backend users to call administrative methods such as `update_onDelete`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` against any backend user record. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is limited to users with active, authenticated backend sessions (CSRF tokens remain enforced).
Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Policy engine logic in RustFS incorrectly swaps ForAllValues: and ForAnyValue: set-qualifier semantics when paired with negated condition operators (StringNotEquals, StringNotLike, ArnNotEquals, ArnNotLike, StringNotEqualsIgnoreCase), allowing authenticated low-privilege users to bypass IAM-style access controls in versions prior to 1.0.0-beta.12. The root cause is that negation is applied to the aggregate quantifier result rather than to each individual request-value predicate before quantification, meaning partially overlapping policy and request value sets can cause an explicit Deny guardrail to evaluate as Allow - including policies controlling access via jwt:groups and jwt:roles claims. No public exploit has been identified at time of analysis, but the flaw directly undermines the authorization boundary for any deployment relying on negated set-qualifier conditions.
Incorrect authorization in RustFS prior to 1.0.0-beta.12 permits authenticated callers to inject attacker-controlled HTTP request headers into the IAM policy condition value map, overriding server-derived identity keys including userid, username, principaltype, groups, versionid, signatureversion, and jwt:/ldap:-prefixed condition keys. The get_condition_values function folded client-supplied HeaderMap entries without filtering reserved key names, enabling a low-privilege API user to fabricate identity context and satisfy policy conditions granted to other users or groups. No public exploit has been identified at time of analysis, and a vendor-released patch is available as version 1.0.0-beta.12.
Tag-based S3 policy bypass in RustFS distributed object storage allows authenticated users on versions 1.0.0-alpha.64 through pre-rc.1 to circumvent object-level access controls when OPA external authorization is active. The IAM subsystem incorrectly initializes PreparedIamAuth.needs_existing_object_tag for the OPA mode, causing maybe_merge_object_tag_conditions to silently omit s3:ExistingObjectTag/* condition values from policy evaluation - meaning any policy restriction keyed on object tags is effectively ignored. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-released fix is available in 1.0.0-rc.1.
Administrator authentication bypass in Yuxi (xerrors/Yuxi), a large-model-based knowledge base and knowledge-graph agent platform, affects all versions prior to 0.6.2. Because the backend only checks that a JWT is validly signed - without binding it to the specific deployment instance - an admin token minted in any other Yuxi instance, a local test environment, or one forged with the hardcoded default secret 'yuxi_know_secure_key' is accepted as a valid administrator, yielding full backend takeover. There is no public exploit identified at time of analysis, but the fix commit and the hardcoded default key are publicly visible on GitHub, making token forgery trivial wherever the secret was never changed.
Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.
Authentication bypass in Fortinet FortiManager and FortiManager Cloud allows unauthenticated remote attackers to circumvent access controls via an alternate path or channel, potentially gaining full administrative control over managed security infrastructure. Affected version ranges span FortiManager 7.2.5 through 7.6.1 and FortiManager Cloud 7.2.5 through 7.6.1, covering multiple active release branches of this centralized network security management platform. No CISA KEV listing or confirmed public exploit has been identified at time of analysis, but the unauthenticated network vector combined with full C/I/A impact and the high-value nature of the target - a platform governing firewall policy across entire enterprise estates - elevates real-world priority significantly beyond the AC:H qualifier alone.
Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.2) lets a remote unauthenticated attacker log into the GUI/CLI management interface using an arbitrary, made-up username and password, granting full administrative control of the web application firewall. Tracked as CVE-2026-26035 (EUVD-2026-57193) and rated CVSS 9.8, this is an improper-authentication (CWE-287) flaw reported by Fortinet's own PSIRT (FG-IR-26-158). There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the trivial exploitability and network exposure make it a high-priority patch.
Missing authentication in FitSoft's POS System exposes the entire platform to unauthenticated remote attackers who can directly access and fully operate the system over the network without any credential barrier. All versions of the product are affected per the CPE wildcard, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero preconditions are required beyond network reachability. No public exploit has been identified at time of analysis, but the trivial exploitation conditions make this a high-priority remediation target for any deployment with external or semi-trusted network exposure.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub.
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
GPU shader validation bypass in the Linux kernel's drm/vc4 driver allows local low-privileged users to rewrite validated shader bytecode after it has been approved by the GPU security validator. Specifically, vc4_gem_object_mmap() rejects writable mappings of validated shader buffer objects (BOs) but neglects to clear VM_MAYWRITE, enabling a two-step attack: map the BO read-only, then invoke mprotect() to silently upgrade the mapping to PROT_WRITE, bypassing the one-time validation check the GPU trusts unconditionally. No public exploit has been identified and no CISA KEV listing exists, but an EPSS of 17% is elevated for a local-only kernel driver issue, warranting prompt patching on affected Raspberry Pi and BCM283x-based platforms.
Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Missing authorization in calibre's Content Server allows readonly or anonymous users to persist unauthorized annotation changes to library books prior to version 9.12.0. The POST /book-update-annotations endpoint omits the needs_db_write=True decorator flag, causing the router to bypass ctx.check_for_write_access() and pass attacker-controlled JSON directly into the database via db.merge_annotations_for_book(). No public exploit code exists and the vulnerability is absent from CISA KEV, though the trivial one-line root cause lowers the barrier to exploitation on exposed instances.
Unauthenticated read/write access to reproductive-health profiles in the Mira Android app (v4.5.15.4) lets internet-based attackers view, forge, delete, or destroy stored fertility and reproductive health records. The flaw stems from hard-coded credentials (CWE-798) and is reachable over the network with no authentication or user interaction, carrying a CVSS 4.0 base score of 9.3. It was reported through CISA/DHS ICS-CERT as medical advisory ICSMA-26-223-01; no public exploit code or active-exploitation listing has been identified at time of analysis.
BLE peripheral spoofing in Mira Android companion app v4.5.15.4 allows an adjacent attacker to impersonate a Mira hormone analyzer by broadcasting a matching BLE advertisement name substring, bypassing all peripheral authentication. An attacker within Bluetooth range can intercept live session tokens from a victim's device and inject falsified hormone measurements directly into the victim's cloud health record and clinical trend views. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing is identified at time of analysis.
Unauthenticated BLE command execution in Mira hormone monitor firmware v1.7.1.47 build 01070147 allows any attacker within Bluetooth range (10-30 meters) to silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, and trigger denial-of-service via undocumented opcodes - all without credentials or user interaction. The device's static, non-rotating BLE address additionally enables persistent passive tracking of the user across physical encounters. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing identified at time of analysis.
Mira hormone monitor device firmware exposes an unauthenticated BLE characteristic write path that forces the device into bootloader mode when any adjacent BLE central sends a 0x01 value, with no credential verification required. Disclosed via CISA ICS Medical Advisory ICSMA-26-223-01, the vulnerability maps to CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 4.0 score of 7.1 with high availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only commodity BLE hardware and physical proximity.
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth `credentialsId` and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable `workspaceId`. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global `id` alone (and rewrote its `workspaceId`), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fixing commit and PR are public.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.
Authentication bypass in Red Hat's search-v2-api exposes federated search results to unauthenticated remote attackers. The authentication middleware unconditionally skips validation when an HTTP request carries the `Upgrade: websocket` header, allowing any network-reachable attacker to POST to the `/federated` endpoint without credentials. Exploitation yields information disclosure across all configured remote managed hubs - no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, but the CVSS 7.5 score and PR:N vector reflect low-barrier, network-accessible exploitation.
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Cross-tenant project takeover in Taubyte Tau v1.1.10 enables any authenticated GitHub user to read or permanently delete projects belonging to other tenants by supplying arbitrary project IDs to the GET and DELETE /projects/{id} HTTP endpoints. The GitHubTokenHTTPAuth middleware performs only token validity checks, exposing bare KV-store operations (projects.Fetch and project.Delete) to any caller holding a valid GitHub OAuth token without verifying project ownership. No public exploit exists and SSVC confirms no observed exploitation, but the low-privilege requirement (any GitHub account) combined with permanent data destruction capability makes this a critical multi-tenant isolation failure for any exposed Tau deployment.
ORM injection in NetBox 4.5.8's WritableNestedSerializer allows any authenticated user - including those holding only read-only API tokens - to extract sensitive field values across all application modules via boolean-based blind data leakage. By supplying crafted Django ORM lookup expressions as JSON dictionary keys in REST API write requests, attackers bypass object-level permission controls across dcim, ipam, tenancy, virtualization, circuits, and extras. No CISA KEV listing exists, but VulnCheck reported the issue and an upstream fix commit is available; no confirmed public exploit code has been identified at time of analysis.
Missing authorization in OpenIM Server v3.8.3 allows any authenticated user to invoke admin-only REST API endpoints and enumerate the entire platform's user and group data. The GetPaginationUsers, GetAllUserID, and GetGroups RPC handlers in internal/rpc/user/user.go and internal/rpc/group/group.go lack the required authverify.CheckAdmin() guard, meaning a regular bearer token is sufficient to harvest all user IDs, nicknames, manager-level flags, and full group listings including private groups the caller has never joined. No public exploit has been identified at time of analysis, but the low attack complexity makes opportunistic exploitation trivial for any credentialed platform user.
Federation-based metadata takeover in PeerTube before 8.2.2 lets a malicious remote ActivityPub server rewrite videos it does not own on a victim instance. Because processUpdateActivity/processUpdateVideo never verify that the signing actor's host matches the host in the target video's id (videoObject.id), any federated peer can push an Update that overwrites another server's video title, description, visibility, stored media file, and HLS playlist URLs. No public exploit or CISA KEV listing is identified at time of analysis, but the flaw is remotely reachable without authentication on the victim and carries a 9.3 CVSS with a scope change.
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorization flaw that lets a remote attacker bypass authentication and run code in the context of the current user. Adobe's PSIRT rates it CVSS 10.0 with a changed scope, meaning a successful attack can impact resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical but the severity is maximal.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.
Authentication bypass in MaxKey identity/SSO server (versions 0 through 4.1.11) lets unauthenticated attackers mint valid JWTs using a hard-coded, publicly known signing secret shipped in application-maxkey.properties and present them to the /sign/login/jwt/trust endpoint to obtain a fully authenticated admin session. Because affected builds ship with JWT login enabled by default (LOGIN_JWT defaulting to true), an attacker can set an arbitrary subject claim to impersonate any user, including administrators, gaining control of SSO application configuration and downstream application secrets. No public exploit identified at time of analysis and no CISA KEV listing, but the trivial exploitation path and VulnCheck advisory make this high priority.
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers with no credentials to access confidential ERP data across a scope boundary. Carrying a CVSS 3.1 score of 8.6 with Scope Changed and High Confidentiality impact, the flaw exposes the underlying Priority ERP backend through the portal layer - meaning business-critical records such as financial data, customer information, or operational records may be readable without any authentication. No public exploit code and no CISA KEV listing exist at time of analysis, but the attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation requires minimal sophistication from any network position.
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote unauthenticated attackers reach protected portal functionality and, because of a scope change, the underlying ERP data it fronts. The maximum CVSS 10.0 rating reflects network reach, no privileges, and high confidentiality and integrity impact. Reported to Israel's INCD; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
WP Helper Premium WordPress plugin before 4.7.6 exposes WooCommerce order data to unauthenticated network attackers via a missing order key authorization check on its custom order confirmation page and related AJAX handlers. Any unauthenticated user can enumerate order IDs to read other customers' personally identifiable information and arbitrarily change the state of any order. No public exploit has been identified at time of analysis, though the SSVC framework rates this as automatable, meaning scripted mass enumeration is technically feasible once the vulnerable module is enabled.
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.
Watch API authorization bypass in etcd allows any authenticated low-privilege user to silently read the entire keyspace beyond their granted key. A user holding a READ grant on a single exact key can invoke the Watch gRPC API with clientv3.WithFromKey() to receive streaming events for every key lexicographically greater than or equal to their permitted key - an unbounded confidentiality breach against etcd's RBAC model. Affected versions span etcd prior to 3.5.33, 3.6.0-3.6.13, and 3.7.0 pre-releases; fixes are released as 3.5.33, 3.6.14, and 3.7.1. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploit path (a single standard gRPC flag) makes weaponization straightforward for any attacker with valid credentials.
Remote unauthenticated authentication bypass in WolfStack before 25.9.2 lets attackers fully compromise container hosts by supplying a hard-coded cluster secret in the X-WolfStack-Secret header. Because the secret is a compile-time constant published in src/auth/mod.rs, anyone who can reach a node's management port passes the require_auth() gate with no session, API key, or account, and can then enumerate every Docker/LXC container and run arbitrary commands as root inside any of them. No public exploit is identified at time of analysis, but the flaw is trivially reproducible from source and was reported by VulnCheck.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.44 lets any authenticated member of a coordination case retrieve coordinator-uploaded attachments that were never marked as shared. The type=track download branch checks only case membership (_is_my_case) and omits the VinceTrackAttachment.shared gate, so a vendor on a case who knows or is sent an artefact's UUID can pull not-yet-released coordinator material. EPSS is low (0.15%, 4th percentile) and no public exploit is identified; this is a logic/authorization defect fixed upstream in PR #235.
Local privilege escalation in IBM Informix Dynamic Server 14.10 and 15.0 allows any low-privileged local OS user to gain root access by exploiting improper access controls in the setuid-root `oninit` utility. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms a low-complexity local attack requiring no user interaction, resulting in full system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a specially crafted query that bypasses authorization controls and gains elevated database privileges, classified as CWE-285 improper authorization. IBM reported the issue and has published a fix; there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low at 0.32% (25th percentile) despite the 9.8 CVSS, indicating no observed mass-exploitation activity yet.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauthenticated remote attackers via inconsistent HTTP request parsing at the reverse proxy layer. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (software and container variants). No public exploit or CISA KEV listing has been identified at time of analysis, but the identity gateway role of this product means a successful bypass could silently undermine authentication enforcement across all downstream resources it protects.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privilege instance configurations into restricted projects. When an instance is migrated to a target project, LXD applies caller-supplied configuration overrides without re-validating them against the destination project's enforced restrictions, so security controls such as privileged-container or device limits can be defeated. Rated CVSS 9.9 (CWE-863) with a scope-changing impact; no public exploit has been identified at time of analysis.
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallowed high-privilege configurations into restricted projects, defeating per-project security controls. The root cause is a time-of-check to time-of-use race in which LXD validates project restrictions before configuration merging finishes during cross-project instance copies. Rated CVSS 9.9 with a scope change; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass via spoofing in Dell Display and Peripheral Manager (DDPM) for Windows, versions prior to 2.3.0.17, enables local low-privileged attackers to escalate their privileges and execute arbitrary code on affected systems. The flaw (CWE-290) allows an attacker already present on the system to spoof an authenticated identity, circumventing DDPM's internal access controls. Dell has released a patched version (2.3.0.17) via advisory DSA-2026-320; no public exploit or CISA KEV listing has been identified at time of analysis.
Elevation of privilege and arbitrary code execution in Dell Display and Peripheral Manager (DDPM) for Windows, all versions prior to 2.3.0.17, is achievable by a low-privileged local attacker exploiting an authentication bypass by spoofing flaw. The CWE-284 root cause - improper access control - allows the attacker to circumvent DDPM's privilege verification, resulting in full confidentiality, integrity, and availability compromise on the affected host. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; Dell has released the corrective patch in version 2.3.0.17 via advisory DSA-2026-320.
Elevation of privilege and arbitrary code execution in Dell Display and Peripheral Manager (DDPM) for Windows allows a low-privileged local attacker on affected systems to bypass access controls and run code at a higher privilege level. All DDPM versions prior to 2.3.0.17 are affected, as confirmed by Dell advisory DSA-2026-320. No public exploit code or CISA KEV listing has been identified at time of analysis, though tags indicate RCE and authentication bypass primitives are involved, consistent with the CWE-284 root cause.
Local privilege escalation in Dell Display and Peripheral Manager (DDPM) for Windows enables a low-privileged local attacker to bypass access controls and execute arbitrary code at elevated privileges, affecting all versions prior to 2.3.0.17. The root cause is an improper access control flaw classified as CWE-290 (Authentication Bypass by Capture-replay), through which a standard user account can subvert DDPM's privileged service process and achieve system-level code execution. Dell has released version 2.3.0.17 via advisory DSA-2026-320, and no public exploit or active exploitation has been identified at time of analysis.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated user smuggle disallowed instance configurations into a restricted project by triggering a cross-project, cross-cluster-member migration. Because the migration arrives at the destination node as an internal cluster notification, the destination skips all target-project restriction checks (CWE-863), so limits and security restrictions on the target project are not enforced. Rated CVSS 9.9; reported by Canonical with a vendor patch available, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privileged remote code execution in ScadaLTS 2.7.8.1 lets any authenticated user - including accounts holding only low-privilege, read-only permissions - invoke a server-side method that performs no authorization check and run arbitrary OS commands. Because the ScadaLTS server process runs as root, a successful call yields full compromise of the underlying host, turning a low-value SCADA login into total system takeover. Reported by Tenable (TRA-2026-55); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted project escape that project's security policy by migrating an instance into it. Because instancePostMigration never re-validated the incoming instance against the target project's enforced restrictions, an attacker could build a high-privilege or otherwise disallowed instance inside an unrestricted project and relocate it into the restricted one, inheriting capabilities (low-level container access, arbitrary devices, unrestricted network access) that the project was configured to forbid. Rated CVSS 9.9 by the vendor; no public exploit identified at time of analysis and it is not in CISA KEV.
Authentication bypass in SiYuan's kernel CheckAuth function unconditionally grants administrator privileges (RoleAdministrator) to any HTTP request whose RemoteAddr is 127.0.0.1, affecting a specific set of endpoints including /api/system/exit, /assets/*, and /export/*, even when an access auth code is explicitly configured. All versions up to and including v3.7.2 are affected; v3.7.4 contains the vendor-released patch. The fixed-port reverse proxy forwards requests to the kernel over loopback without injecting authentication tokens or configuring trusted proxy headers, creating a theoretical remote unauthenticated attack path if the proxy is bound to a network-accessible interface - though per the advisory this remote scenario was established only by code inspection and was not reproduced end-to-end. No public exploit code exists and this CVE is not listed in the CISA KEV catalog.
Sensitive data disclosure in SiYuan note-taking application before v3.7.4 lets anonymous readers of a published workspace pull Relation and Rollup cell contents out of hidden or password-protected databases. Because renderAttributeView does not re-check authorization on the related database, an unauthenticated visitor can request a published attribute view that references a restricted database and read its protected values, and can bypass row-level filtering entirely when the first column is a non-block type. Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis.
Unauthorized cross-document content disclosure in SiYuan note-taking software before v3.7.4 allows remote attackers to read protected notes without credentials. The getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints resolve embed queries inside published blocks without re-checking publish-access controls, so an attacker who reaches a published SiYuan workspace can pull back content from password-protected, hidden, or forbidden documents. No public exploit identified at time of analysis, but VulnCheck rates it CVSS 9.2 (CVSS 4.0) and it constitutes an authentication/authorization bypass.
Anonymous information disclosure in SiYuan before v3.7.4 lets unauthenticated remote readers retrieve fully decrypted content from encrypted notebooks. Because the publish API treats encrypted notebooks as publicly accessible by default, any anonymous visitor can enumerate and read documents from an unlocked encrypted notebook without authentication or knowledge of the encryption key. Reported by VulnCheck and rated CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Improper authorization in Craft CMS 5.0.0-RC1 through 5.10.7 exposes the generic `elements/save` action to silent password manipulation, enabling any authenticated control panel user to reset their own password without confirming their current credentials. More critically, attackers holding the `edit users` permission can silently overwrite passwords for any account on the platform-including administrator accounts-achieving full administrative takeover without requiring the legitimately guarded `Administrate users` privilege. A vendor-released patch exists in version 5.10.8, and no public exploit code is identified at time of analysis, though the GHSA advisory's detailed technical description materially lowers the bar for independent exploitation.
Privilege escalation in GitLab Enterprise Edition exposes project governance controls to any authenticated project member due to missing authorization checks on the project update API endpoint. Affecting EE versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1, this flaw lets lower-privileged users (developers, reporters) silently overwrite project settings normally restricted to maintainers or owners - including branch protection rules, merge approval requirements, and access policies. A publicly available exploit exists via HackerOne; active exploitation is not confirmed by CISA KEV, but the low attack complexity combined with public proof-of-concept code significantly elevates operational urgency.
Improper authorization of namespace identity in GitLab Enterprise Edition 19.1.x and 19.2.x allows an authenticated low-privilege user to attribute AI feature usage to arbitrary namespaces they do not own, crossing organizational authorization boundaries within a multi-tenant deployment. The flaw, classified as CWE-639, arises because user-supplied identity information in requests is insufficiently validated before being used to authorize namespace-scoped AI operations, producing a scope change that affects namespaces beyond the attacker's own. GitLab has released patches in versions 19.1.4 and 19.2.2, and no public exploit code exists at time of analysis.
Full account takeover is possible in Budibase's account portal via an Insecure Direct Object Reference (IDOR) in the email-change API endpoint, affecting all versions prior to 3.40.0. POST /api/v2/email on account.budibase.app accepts a client-supplied accountId without binding it to the authenticated session - an authenticated attacker who obtains a victim's accountId UUID can redirect the email-change verification code to an attacker-controlled address, then complete a password reset to seize the victim's account entirely without any victim interaction required. No public exploit code has been identified at time of analysis; the vulnerability is fixed in Budibase 3.40.0.
Improper authorization in GitLab CE/EE pipeline reference validation allows authenticated developer-role users to execute CI/CD pipelines on protected branches they lack push permissions to access, effectively bypassing branch protection policies. All GitLab versions from 19.0 through 19.2 are affected until the respective patch releases. A publicly available exploit exists via HackerOne report #3832069, though no confirmed active exploitation has been recorded in the CISA KEV catalog at time of analysis.
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.
Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
Security restriction bypass in IBM i 7.3 through 7.6 enables remote authenticated attackers to elevate privileges via unsafe Java reflection (CWE-915), allowing dynamic modification of object attributes in ways the platform's access control layer does not anticipate. The CVSS 8.3 score reflects network reachability, low attack complexity, and high confidentiality and integrity impact - meaning any valid low-privilege account can exploit this without user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low barrier to exploitation (PR:L, AC:L) makes this a credible lateral-movement or privilege-escalation path in IBM i shops.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an ADB-connected Android device before version 3.0.8. The create_mobile_data_collection_server and create_mobile_action_server components bind Streamable HTTP MCP services to TCP 8020 and 8021 with no credential check, exposing tools such as capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control to anyone who can reach the ports. No public exploit identified at time of analysis, but the fix (adding UFO_MCP_API_KEY bearer auth) is confirmed in the vendor advisory GHSA-24fq-m9rr-g3mm and release v3.0.8, and the high EPSS-relevant impact (CVSS 9.4) makes this a serious exposure wherever the mobile agent is run on a reachable interface.
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Progress Software WhatsUp Gold (all versions before 2026.0.2) allows unauthenticated attackers with adjacent network access to invoke a critical function exposed without authentication (CWE-306), executing arbitrary code as the IIS application service account. The CVSS 3.1 score of 8.8 with PR:N and UI:N confirms zero-credential, zero-interaction exploitation against all pre-patch deployments. No public exploit has been identified at time of analysis, but a vendor patch is available in version 2026.0.2 per the August 2026 security bulletin.
Insufficient input validation on the `_handler` POST field in Winter CMS's form postback mechanism allows any authenticated backend user to invoke arbitrary controller methods-including protected and private ones-bypassing role-based permission checks. The Users controller compounded this by conditionally nullifying its `$requiredPermissions` for the `myaccount` action, enabling low-privilege backend users to call administrative methods such as `update_onDelete`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` against any backend user record. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is limited to users with active, authenticated backend sessions (CSRF tokens remain enforced).
Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Policy engine logic in RustFS incorrectly swaps ForAllValues: and ForAnyValue: set-qualifier semantics when paired with negated condition operators (StringNotEquals, StringNotLike, ArnNotEquals, ArnNotLike, StringNotEqualsIgnoreCase), allowing authenticated low-privilege users to bypass IAM-style access controls in versions prior to 1.0.0-beta.12. The root cause is that negation is applied to the aggregate quantifier result rather than to each individual request-value predicate before quantification, meaning partially overlapping policy and request value sets can cause an explicit Deny guardrail to evaluate as Allow - including policies controlling access via jwt:groups and jwt:roles claims. No public exploit has been identified at time of analysis, but the flaw directly undermines the authorization boundary for any deployment relying on negated set-qualifier conditions.
Incorrect authorization in RustFS prior to 1.0.0-beta.12 permits authenticated callers to inject attacker-controlled HTTP request headers into the IAM policy condition value map, overriding server-derived identity keys including userid, username, principaltype, groups, versionid, signatureversion, and jwt:/ldap:-prefixed condition keys. The get_condition_values function folded client-supplied HeaderMap entries without filtering reserved key names, enabling a low-privilege API user to fabricate identity context and satisfy policy conditions granted to other users or groups. No public exploit has been identified at time of analysis, and a vendor-released patch is available as version 1.0.0-beta.12.
Tag-based S3 policy bypass in RustFS distributed object storage allows authenticated users on versions 1.0.0-alpha.64 through pre-rc.1 to circumvent object-level access controls when OPA external authorization is active. The IAM subsystem incorrectly initializes PreparedIamAuth.needs_existing_object_tag for the OPA mode, causing maybe_merge_object_tag_conditions to silently omit s3:ExistingObjectTag/* condition values from policy evaluation - meaning any policy restriction keyed on object tags is effectively ignored. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-released fix is available in 1.0.0-rc.1.
Administrator authentication bypass in Yuxi (xerrors/Yuxi), a large-model-based knowledge base and knowledge-graph agent platform, affects all versions prior to 0.6.2. Because the backend only checks that a JWT is validly signed - without binding it to the specific deployment instance - an admin token minted in any other Yuxi instance, a local test environment, or one forged with the hardcoded default secret 'yuxi_know_secure_key' is accepted as a valid administrator, yielding full backend takeover. There is no public exploit identified at time of analysis, but the fix commit and the hardcoded default key are publicly visible on GitHub, making token forgery trivial wherever the secret was never changed.
Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.
Authentication bypass in Fortinet FortiManager and FortiManager Cloud allows unauthenticated remote attackers to circumvent access controls via an alternate path or channel, potentially gaining full administrative control over managed security infrastructure. Affected version ranges span FortiManager 7.2.5 through 7.6.1 and FortiManager Cloud 7.2.5 through 7.6.1, covering multiple active release branches of this centralized network security management platform. No CISA KEV listing or confirmed public exploit has been identified at time of analysis, but the unauthenticated network vector combined with full C/I/A impact and the high-value nature of the target - a platform governing firewall policy across entire enterprise estates - elevates real-world priority significantly beyond the AC:H qualifier alone.
Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.2) lets a remote unauthenticated attacker log into the GUI/CLI management interface using an arbitrary, made-up username and password, granting full administrative control of the web application firewall. Tracked as CVE-2026-26035 (EUVD-2026-57193) and rated CVSS 9.8, this is an improper-authentication (CWE-287) flaw reported by Fortinet's own PSIRT (FG-IR-26-158). There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the trivial exploitability and network exposure make it a high-priority patch.
Missing authentication in FitSoft's POS System exposes the entire platform to unauthenticated remote attackers who can directly access and fully operate the system over the network without any credential barrier. All versions of the product are affected per the CPE wildcard, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero preconditions are required beyond network reachability. No public exploit has been identified at time of analysis, but the trivial exploitation conditions make this a high-priority remediation target for any deployment with external or semi-trusted network exposure.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub.
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
GPU shader validation bypass in the Linux kernel's drm/vc4 driver allows local low-privileged users to rewrite validated shader bytecode after it has been approved by the GPU security validator. Specifically, vc4_gem_object_mmap() rejects writable mappings of validated shader buffer objects (BOs) but neglects to clear VM_MAYWRITE, enabling a two-step attack: map the BO read-only, then invoke mprotect() to silently upgrade the mapping to PROT_WRITE, bypassing the one-time validation check the GPU trusts unconditionally. No public exploit has been identified and no CISA KEV listing exists, but an EPSS of 17% is elevated for a local-only kernel driver issue, warranting prompt patching on affected Raspberry Pi and BCM283x-based platforms.
Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Missing authorization in calibre's Content Server allows readonly or anonymous users to persist unauthorized annotation changes to library books prior to version 9.12.0. The POST /book-update-annotations endpoint omits the needs_db_write=True decorator flag, causing the router to bypass ctx.check_for_write_access() and pass attacker-controlled JSON directly into the database via db.merge_annotations_for_book(). No public exploit code exists and the vulnerability is absent from CISA KEV, though the trivial one-line root cause lowers the barrier to exploitation on exposed instances.
Unauthenticated read/write access to reproductive-health profiles in the Mira Android app (v4.5.15.4) lets internet-based attackers view, forge, delete, or destroy stored fertility and reproductive health records. The flaw stems from hard-coded credentials (CWE-798) and is reachable over the network with no authentication or user interaction, carrying a CVSS 4.0 base score of 9.3. It was reported through CISA/DHS ICS-CERT as medical advisory ICSMA-26-223-01; no public exploit code or active-exploitation listing has been identified at time of analysis.
BLE peripheral spoofing in Mira Android companion app v4.5.15.4 allows an adjacent attacker to impersonate a Mira hormone analyzer by broadcasting a matching BLE advertisement name substring, bypassing all peripheral authentication. An attacker within Bluetooth range can intercept live session tokens from a victim's device and inject falsified hormone measurements directly into the victim's cloud health record and clinical trend views. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing is identified at time of analysis.
Unauthenticated BLE command execution in Mira hormone monitor firmware v1.7.1.47 build 01070147 allows any attacker within Bluetooth range (10-30 meters) to silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, and trigger denial-of-service via undocumented opcodes - all without credentials or user interaction. The device's static, non-rotating BLE address additionally enables persistent passive tracking of the user across physical encounters. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing identified at time of analysis.
Mira hormone monitor device firmware exposes an unauthenticated BLE characteristic write path that forces the device into bootloader mode when any adjacent BLE central sends a 0x01 value, with no credential verification required. Disclosed via CISA ICS Medical Advisory ICSMA-26-223-01, the vulnerability maps to CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 4.0 score of 7.1 with high availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only commodity BLE hardware and physical proximity.
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth `credentialsId` and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable `workspaceId`. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global `id` alone (and rewrote its `workspaceId`), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fixing commit and PR are public.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.
Authentication bypass in Red Hat's search-v2-api exposes federated search results to unauthenticated remote attackers. The authentication middleware unconditionally skips validation when an HTTP request carries the `Upgrade: websocket` header, allowing any network-reachable attacker to POST to the `/federated` endpoint without credentials. Exploitation yields information disclosure across all configured remote managed hubs - no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, but the CVSS 7.5 score and PR:N vector reflect low-barrier, network-accessible exploitation.
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Cross-tenant project takeover in Taubyte Tau v1.1.10 enables any authenticated GitHub user to read or permanently delete projects belonging to other tenants by supplying arbitrary project IDs to the GET and DELETE /projects/{id} HTTP endpoints. The GitHubTokenHTTPAuth middleware performs only token validity checks, exposing bare KV-store operations (projects.Fetch and project.Delete) to any caller holding a valid GitHub OAuth token without verifying project ownership. No public exploit exists and SSVC confirms no observed exploitation, but the low-privilege requirement (any GitHub account) combined with permanent data destruction capability makes this a critical multi-tenant isolation failure for any exposed Tau deployment.
ORM injection in NetBox 4.5.8's WritableNestedSerializer allows any authenticated user - including those holding only read-only API tokens - to extract sensitive field values across all application modules via boolean-based blind data leakage. By supplying crafted Django ORM lookup expressions as JSON dictionary keys in REST API write requests, attackers bypass object-level permission controls across dcim, ipam, tenancy, virtualization, circuits, and extras. No CISA KEV listing exists, but VulnCheck reported the issue and an upstream fix commit is available; no confirmed public exploit code has been identified at time of analysis.
Missing authorization in OpenIM Server v3.8.3 allows any authenticated user to invoke admin-only REST API endpoints and enumerate the entire platform's user and group data. The GetPaginationUsers, GetAllUserID, and GetGroups RPC handlers in internal/rpc/user/user.go and internal/rpc/group/group.go lack the required authverify.CheckAdmin() guard, meaning a regular bearer token is sufficient to harvest all user IDs, nicknames, manager-level flags, and full group listings including private groups the caller has never joined. No public exploit has been identified at time of analysis, but the low attack complexity makes opportunistic exploitation trivial for any credentialed platform user.
Federation-based metadata takeover in PeerTube before 8.2.2 lets a malicious remote ActivityPub server rewrite videos it does not own on a victim instance. Because processUpdateActivity/processUpdateVideo never verify that the signing actor's host matches the host in the target video's id (videoObject.id), any federated peer can push an Update that overwrites another server's video title, description, visibility, stored media file, and HLS playlist URLs. No public exploit or CISA KEV listing is identified at time of analysis, but the flaw is remotely reachable without authentication on the victim and carries a 9.3 CVSS with a scope change.
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorization flaw that lets a remote attacker bypass authentication and run code in the context of the current user. Adobe's PSIRT rates it CVSS 10.0 with a changed scope, meaning a successful attack can impact resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical but the severity is maximal.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.
Authentication bypass in MaxKey identity/SSO server (versions 0 through 4.1.11) lets unauthenticated attackers mint valid JWTs using a hard-coded, publicly known signing secret shipped in application-maxkey.properties and present them to the /sign/login/jwt/trust endpoint to obtain a fully authenticated admin session. Because affected builds ship with JWT login enabled by default (LOGIN_JWT defaulting to true), an attacker can set an arbitrary subject claim to impersonate any user, including administrators, gaining control of SSO application configuration and downstream application secrets. No public exploit identified at time of analysis and no CISA KEV listing, but the trivial exploitation path and VulnCheck advisory make this high priority.