Authentication Bypass
Monthly
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
Missing authentication in Universal Software Inc. UKBS through version 28072026 allows adjacent network attackers to access restricted critical functionality without credentials, resulting in complete compromise of confidentiality, integrity, and availability. The vendor has confirmed the product is no longer supported, leaving all installations permanently vulnerable. No active exploitation or public exploit code has been reported.
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Missing authorization in the insert path of an unspecified product's configuration table enables a low-privileged remote attacker to gain administrator privileges, leading to full system access. The specific affected product and version are not disclosed in the limited advisory information; no data on active exploitation or patch availability is provided.
Inadequate authorization
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
A sandbox escape in macOS allows a malicious application to break out of its sandbox due to an authorization flaw in state management. Fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, the vulnerability could enable a local app with user interaction to read and modify protected data. No active exploitation or public proof-of-concept code has been identified.
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
Privacy bypass in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious application to circumvent Transparency, Consent, and Control (TCC) protections, granting unauthorized access to sensitive data and system resources. The vulnerability stems from an authorization flaw resolved via improved state management. No public exploit or active exploitation is known at this time, and EPSS estimates a very low (0.16%) chance of exploitation.
Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
Local privilege escalation in macOS allows a malicious application to bypass network restrictions, potentially exposing sensitive data or manipulating network traffic. The vulnerability affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and requires user interaction (e.g., installing a rogue app). Apple has released patches; no active exploitation or public exploit code has been identified.
A logic flaw in macOS allows a malicious app to intercept network connections intended for other processes. Affected versions prior to macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 can be exploited to read or modify traffic of other apps. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread attack.
Sandbox escape in macOS allows a malicious app to break out of its restrictions and gain full system access. Affected systems include macOS Sonoma before 14.8.8, macOS Sequoia before 15.7.8, and macOS Tahoe before 26.6. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low at 0.16%.
Sandbox escape in macOS allows a malicious application to break out of its sandbox and gain arbitrary access to the underlying operating system. All versions prior to the fixed releases (macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6) are affected. No public exploit or active exploitation has been observed at the time of analysis.
An authentication-handling weakness in JFrog Artifactory's internal request processing lets an attacker who already holds a low-privileged account elevate to a higher access level, potentially reaching administrative control of the artifact repository. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High) with CWE-287 as the root cause class, the flaw affects six self-managed release branches and is fixed in 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34 and 7.161.15. There is no CISA KEV listing or public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), so this reads as a patching-hygiene issue rather than an emergency zero-day.
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Unauthorized account access in Ekushey Project Manager CRM allows authenticated administrators to create duplicate client accounts with identical email and password credentials. An authenticated admin can exploit the missing email uniqueness enforcement to create conflicting account states, causing unpredictable authentication and potential unauthorized access to victim accounts. A proof-of-concept exploit is publicly available.
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%).
An authenticated SQL injection in an API component of Arista's VeloCloud Orchestrator On-Prem allows a user holding valid credentials to manipulate backend queries, exposing data beyond their intended privileges and causing the orchestrator to initiate unintended outbound network connections. Only on-prem installations on the 5.2.0, 6.1.0 and 6.4.0 branches before 5.2.3.14, 6.1.3.4 and 6.4.2.4 are affected; exploitation requires a working authenticated session (CVSS vector PR:L), so anonymous attacks are not possible, and exposure is further narrowed because the orchestrator management plane is normally reachable only from admin or management networks. EPSS is 2.83% (85th percentile) with no public exploit code and no active exploitation reported, and while the vendor's CVSS 4.0 base score is 8.5, our independent assessment treats this as a moderate-priority rather than top-priority issue given the authentication prerequisite and the on-prem-only, restricted-reachability attack surface.
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by the client, bypassing certificate validation and enabling full traffic decryption and manipulation. This affects OTP versions 17.0 through prior to 27.3.4.15, 28.5.0.4, and 29.0.4. The vulnerability is resolved in patched releases; no active exploitation or public proof-of-concept is known at this time.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time.
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis.
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.
Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated attacker with a modified app on the adjacent network to connect to the robot while a legitimate operator is active. The attacker can intercept real-time video and send commands without alerting the legitimate user, compromising confidentiality and operational control. No active exploitation or public exploit code has been identified; a vendor patch is available.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposing its web administration interface and HTTP API - lets an unauthenticated attacker who is associated to the robot's own internal Wi-Fi network take full control of the platform (CWE-306). From that position the attacker can view live camera feeds, command movement, manage the GPS, RTK, SAM and LIDAR sensor suite, and issue critical operational commands including Play, Pause, Stop and E-Stop, resulting in complete loss of confidentiality, integrity and physical safety. Exploitation is bounded by the requirement to be within and joined to the robot's private Wi-Fi (CVSS 4.0 AV:A, PR:N, score 8.7), it is assessed as not automatable, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.19% (10th percentile), consistent with a technically severe but narrowly reachable flaw.
Privilege separation flaw in containerized-data-importer's view ClusterRole allows authenticated users with cluster-wide view permissions and write access to any namespace to clone and exfiltrate PersistentVolumeClaim (PVC) contents into a controlled namespace, bypassing namespace isolation and read-only guarantees. The vulnerability permits data theft across the cluster without requiring direct access to source namespaces.
Unauthenticated attackers can gain access to live video snapshots from CP PLUS EZ-P21 IP Camera (v4.8.8.1 and prior) by brute‐forcing the HTTP authentication endpoint. The vulnerability stems from a missing brute‐force protection mechanism, allowing remote password guessing without rate limiting or account lockout. Successful exploitation reveals high‐confidentiality video data. No active exploitation or public exploit code is known at this time.
Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Authentication bypass in the 微信二维码登陆 WordPress plugin through 1.3 allows unauthenticated attackers to log in as any existing user, including administrators, by forging webhook requests and intercepting leaked login codes. A publicly available proof-of-concept exists, the attack is fully automatable, and the technical impact is total, making this a critical priority for any site using the plugin.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Authenticated users in Leantime 3.6.2 and earlier can bypass project access controls to read milestone data from any project on the instance. By supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint, an attacker can enumerate and retrieve sensitive project planning information, including titles, descriptions, and timelines, without membership. A fix is available; exploitation details are public but no active exploitation has been reported.
Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to redirect or block push notifications to legitimate consoles. By supplying a known console asset identifier, an attacker can bypass authentication on the registration API to overwrite notification tokens and metadata, disrupting notification delivery. The issue is tracked as CVE-2026-66013; no public exploit is confirmed at time of analysis.
Unauthenticated remote administrator takeover in SiYuan before v3.7.2 via missing authorization on the /mcp kernel endpoint. When the Publish server is in anonymous mode, a remote attacker can invoke 31 MCP tools—including full file-system read, write, and delete—to exfiltrate secrets from conf/conf.json and plant a malicious plugin that runs with elevated desktop privileges. While no active exploitation has been confirmed by CISA KEV, detailed exploit information is publicly available, and the vulnerability carries a maximum CVSS severity.
Data zeroing attack in the Linux kernel's ksmbd SMB server allows an authenticated client to destroy file contents without requiring FILE_WRITE_DATA permission. A handle opened with only FILE_WRITE_ATTRIBUTES is sufficient to send FSCTL_SET_ZERO_DATA, bypassing the missing per-handle access check. Publicly available exploit code exists, and vendor patches have been released.
Authorization bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network client to rewrite any accessible file's security descriptor - including DACL and owner - without holding WRITE_DAC or WRITE_OWNER rights on the file handle. A client opening a handle with only FILE_WRITE_ATTRIBUTES can issue SMB2 SET_INFO with InfoType SMB2_O_INFO_SECURITY to invoke set_info_sec(), which rewrites POSIX ACLs, ownership via notify_change(), and (on KSMBD_SHARE_FLAG_ACL_XATTR shares) the Windows SD xattr, all without any fp->daccess gate. No public exploit has been identified; EPSS is 0.22%, and patches are confirmed in kernel stable series 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1.
Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.
Remote authentication bypass in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated attackers to gain full administrative access by submitting empty credentials. This enables control of power relays, device reboot, and network configuration, potentially causing physical equipment damage. No active exploitation or public exploit has been reported at this time.
Cloudreve versions earlier than 4.17.0 contain an incorrect authorization flaw in the OAuth scoping of admin storage policy routes. An attacker with a bearer token scoped only to Admin.Read can send a request to the vulnerable endpoint and overwrite OneDrive storage policy credentials, violating the intended scope boundary. A publicly available proof-of-concept exists, and the vendor has released a patched version.
Information disclosure in Microsoft Azure Portal allows a remote, unauthenticated attacker to access sensitive data they are not authorized to view by exploiting an improper authorization check (CWE-285) reachable over the network. The flaw affects the cloud-hosted Azure management console and, per its CVSS vector, requires no privileges or user interaction while yielding high confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the issue is assessed as automatable; the EPSS probability is modest at 1.03%.
Message content overwrite in Open WebUI's chat completion API allows any authenticated user to modify messages in channels they do not belong to, including private and DM channels. By crafting a request with a `channel:`-prefixed chat_id and a target message_id, an attacker can overwrite a message's content while retaining the original author attribution, effectively impersonating the victim. A publicly available proof-of-concept exploit exists, and the vulnerability affects versions 0.9.5 through 0.9.9.
Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt passwords of arbitrary vault accounts and store them in public links, enabling unauthenticated retrieval if the link hash is obtained. No active exploitation is confirmed, but public exploit code exists; EPSS probability is low (0.18%).
Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, overwrite passwords, and delete any account across the vault without per-account access controls. A public proof-of-concept is available, though EPSS indicates low exploitation probability (0.22%).
Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.
We are tasked to produce a JSON analysis for CVE-2026-66027 based on the provided data. The analysis must synthesize all the information, cross-reference, and produce a coherent summary, technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. We have: - CVE: CVE-2026-66027 - Description: broken access control in message queue API of Suna before 0.9.102, allowing authenticated attackers to access/manipulate other users' queue resources. Can read pending prompt queues, read/delete individual sessions, inject prompts into another user's session queue, causing background drainer to forward malicious messages to victim's running AI agent with victim's credentials. - CVSS Score: 8.7 (base score based on CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-862 (Missing Authorization) - Multi-source: EPSS 0.26% (percentile 17%) so low exploitation probability. POC/Exploit: Publicly available. Patch: Available from vendor. Reported by VulnCheck. - CPE: cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* (so product is Suna from kortix-ai). - Tags: Authentication Bypass, Suna - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. - ENISA EUVD ID confirms affected versions: suna 0 <0.9.102. So all versions before 0.9.102 are affected. - References: - exploit: https://github.com/geo-chen/oss/blob/main/suna.md (likely a writeup) - release: https://github.com/kortix-ai/suna/releases/tag/v0.9.102 - pull request: https://github.com/kortix-ai/suna/pull/4373 (security fix PR) - patch commit: https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a - vulncheck advisory: https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api - NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-66027
Complete cluster compromise via missing authentication in Microsoft Azure Kubernetes Service allows any unauthenticated remote attacker to gain administrative privileges over the network. No user interaction is required, and the vulnerability is automatable, enabling full cluster takeover with potential cross-tenant impact. No public exploit code or active exploitation has been reported, and a vendor patch is available.
Privilege escalation in Microsoft Azure App Service for Linux lets a remote, unauthenticated attacker bypass access controls and gain elevated privileges over the network, per Microsoft's MSRC advisory and a CVSS 9.8 rating. Because the underlying weakness is improper access control (CWE-284), a successful attack yields total confidentiality, integrity, and availability impact on the affected app-hosting environment. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CISA's SSVC assessment flags the flaw as automatable with total technical impact, and the modest EPSS score (0.81%) reflects an as-yet-unproven-but-realistic exploitation path.
Una
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
Privilege escalation and unauthorized data modification in the Grafana IRM cloud service allowed authenticated low-privilege users to perform operations on behalf of other users due to broken access controls, potentially leading to account takeover. The vulnerability affected cloud-only deployments of versions 1.0.0 through 1.164.0 and has been automatically resolved; self-hosted environments are not impacted. The EPSS exploitation probability is low (0.29%) and no active exploitation is known.
Privilege escalation via authorization bypass in EventON Action User for WordPress allows unauthenticated attackers to grant management and file-upload capabilities to any non-administrator role or user. The same endpoint also leaks user IDs, display names, capability states, and nonces, and lets attackers tamper with event-to-user assignments. No public exploit or active exploitation has been identified, but the vulnerability is trivially automatable.
Authorization bypass in Eclipse BaSyx Go Components through 1.0.0 lets unauthenticated network attackers reach ABAC-protected API handlers by appending a trailing slash to a route (e.g. GET /shells/ instead of GET /shells). The ABAC middleware evaluates the slashed path, finds no matching policy route, and passes the request onward, after which Chi's middleware.StripSlashes normalizes the path and executes the protected handler with no ABAC decision and none of the expected ABAC query filters. Publicly available upstream fix exists (PR #442, v1.0.1) and SSVC rates technical impact as total, though EPSS is low (0.35%) and no active exploitation is confirmed.
Unauthorized REST endpoint in WowOptin Popup Maker for WordPress (versions <1.4.38) allows unauthenticated attackers to disable all site opt-in forms and insert arbitrary template-based rows into the database. Public exploit code is available, though no active exploitation is reported. EPSS indicates a very low likelihood of widespread attack.
Unauthenticated SQL injection in the 'Project Management, Bug and Issue Tracking Plugin' for WordPress before version 5.1.0 enables remote attackers to extract or modify database contents via the standard front-end issue tracker. Exploit code is publicly available, and the vulnerability has a high CVSS score of 9.1, though EPSS probability remains low at 0.14%.
Privilege elevation in Microsoft Azure DNS lets a remote, unauthenticated attacker bypass authorization checks over the network to gain elevated permissions within the DNS service. The flaw stems from a missing authorization check (CWE-862) and carries a critical CVSS 9.8 with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS estimates a modest 0.67% 30-day exploitation probability, but CISA's SSVC framework flags the issue as automatable with total technical impact.
Authentication bypass in Microsoft Azure Key Vault lets a remote, unauthenticated attacker elevate privileges over the network and gain unauthorized access to the secrets, keys, and certificates the service protects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with full confidentiality, integrity, and availability impact. A vendor patch is available; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.70%, 49th percentile) despite CISA SSVC flagging the flaw as automatable with total technical impact.
Improper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication controls and tamper with data across a security boundary, with a maximum CVSS 3.1 base score of 10.0 driven by network reachability, no privileges required, and a scope change (S:C). Although the description emphasizes tampering (integrity), the CVSS vector rates confidentiality, integrity, and availability all High, indicating broad potential impact against Microsoft's multi-tenant cloud email service. No public exploit identified at time of analysis (E:U), and Microsoft has already deployed an official fix (RL:O) service-side.
Remote code execution in Microsoft Azure API Management (APIM) allows an authorized network attacker to achieve full system compromise via improper access control. The vulnerability (CWE-284) is tagged 'Authentication Bypass,' suggesting that despite requiring high privileges for initial entry, the flaw may allow an attacker to circumvent authorization boundaries within APIM and escalate to code execution. No public exploit has been identified at time of analysis, and SSVC confirms no current exploitation; however, the total technical impact (C:H/I:H/A:H) makes patching a priority for any organization running Azure API Management workloads.
Privilege escalation in Azure Red Hat OpenShift (ARO) lets an already-authenticated network attacker with limited rights (PR:L) bypass authorization controls (CWE-285) to gain elevated privileges with full confidentiality, integrity, and availability impact. Because the CVSS scope is changed (S:C), the compromise can extend beyond the initially authorized boundary into other components of the managed cluster or platform. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the 9.9 CVSS and SSVC 'total' technical impact make it a high-priority patch for any ARO tenant.
Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Zalando Skipper (all versions through 0.27.25) lets remote unauthenticated attackers evade Open Policy Agent body-content authorization by padding a request past the configured maxBodyBytes limit. Because Skipper forwards the oversized payload upstream while handing OPA an empty parsed_body, deny-on-presence Rego policies fail open and forbidden actions execute. This is an incomplete fix for CVE-2026-50197; publicly available exploit code exists (docker-compose PoC in the GHSA advisory), but there is no public evidence of active exploitation and no code-level fix - v0.27.26 only adds documentation.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote unauthenticated attackers defeat identity verification and gain full control over the managed file transfer server. Because MOVEit is a high-value data-exchange gateway, a successful bypass exposes all hosted files and administrative functions. No public exploit identified at time of analysis, and EPSS probability is low (0.18%, 8th percentile) despite the 9.8 CVSS, reflecting no observed exploitation yet.
Unauthenticated arbitrary blob creation in Chatwoot before 4.16.0 lets remote attackers abuse the ActiveStorage direct-uploads controller, which lacks authentication (CWE-306), to resolve any tenant's account and conversation and obtain signed PUT URLs for writing attacker-controlled data into the shared storage backend. The flaw affects all self-hosted and multi-tenant Chatwoot deployments prior to 4.16.0, is reported by VulnCheck, and has publicly available exploit code exists (no CISA KEV listing). The CVSS 4.0 vector emphasizes integrity impact (VI:H) with a secondary availability effect (VA:L) and no confidentiality loss.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Cross-tenant privilege abuse in CyberPanel through 1.9.1 lets any authenticated panel user read, delete, or restore other tenants' incremental backups by supplying a guessed IncJob integer ID that the IncBackups handlers never re-scope to the caller's own domain. The flaw affects the deleteBackup, fetchRestorePoints, and restorePoint endpoints; because IncJob IDs are globally sequential, an attacker can trivially enumerate victims, and unauthorized restores execute with root privileges. No public exploit identified at time of analysis, but the root cause and fix are fully disclosed in vendor commit b198460.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
Missing authentication in Universal Software Inc. UKBS through version 28072026 allows adjacent network attackers to access restricted critical functionality without credentials, resulting in complete compromise of confidentiality, integrity, and availability. The vendor has confirmed the product is no longer supported, leaving all installations permanently vulnerable. No active exploitation or public exploit code has been reported.
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Missing authorization in the insert path of an unspecified product's configuration table enables a low-privileged remote attacker to gain administrator privileges, leading to full system access. The specific affected product and version are not disclosed in the limited advisory information; no data on active exploitation or patch availability is provided.
Inadequate authorization
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
A sandbox escape in macOS allows a malicious application to break out of its sandbox due to an authorization flaw in state management. Fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, the vulnerability could enable a local app with user interaction to read and modify protected data. No active exploitation or public proof-of-concept code has been identified.
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
Privacy bypass in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious application to circumvent Transparency, Consent, and Control (TCC) protections, granting unauthorized access to sensitive data and system resources. The vulnerability stems from an authorization flaw resolved via improved state management. No public exploit or active exploitation is known at this time, and EPSS estimates a very low (0.16%) chance of exploitation.
Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
Local privilege escalation in macOS allows a malicious application to bypass network restrictions, potentially exposing sensitive data or manipulating network traffic. The vulnerability affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and requires user interaction (e.g., installing a rogue app). Apple has released patches; no active exploitation or public exploit code has been identified.
A logic flaw in macOS allows a malicious app to intercept network connections intended for other processes. Affected versions prior to macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 can be exploited to read or modify traffic of other apps. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread attack.
Sandbox escape in macOS allows a malicious app to break out of its restrictions and gain full system access. Affected systems include macOS Sonoma before 14.8.8, macOS Sequoia before 15.7.8, and macOS Tahoe before 26.6. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low at 0.16%.
Sandbox escape in macOS allows a malicious application to break out of its sandbox and gain arbitrary access to the underlying operating system. All versions prior to the fixed releases (macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6) are affected. No public exploit or active exploitation has been observed at the time of analysis.
An authentication-handling weakness in JFrog Artifactory's internal request processing lets an attacker who already holds a low-privileged account elevate to a higher access level, potentially reaching administrative control of the artifact repository. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High) with CWE-287 as the root cause class, the flaw affects six self-managed release branches and is fixed in 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34 and 7.161.15. There is no CISA KEV listing or public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), so this reads as a patching-hygiene issue rather than an emergency zero-day.
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Unauthorized account access in Ekushey Project Manager CRM allows authenticated administrators to create duplicate client accounts with identical email and password credentials. An authenticated admin can exploit the missing email uniqueness enforcement to create conflicting account states, causing unpredictable authentication and potential unauthorized access to victim accounts. A proof-of-concept exploit is publicly available.
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%).
An authenticated SQL injection in an API component of Arista's VeloCloud Orchestrator On-Prem allows a user holding valid credentials to manipulate backend queries, exposing data beyond their intended privileges and causing the orchestrator to initiate unintended outbound network connections. Only on-prem installations on the 5.2.0, 6.1.0 and 6.4.0 branches before 5.2.3.14, 6.1.3.4 and 6.4.2.4 are affected; exploitation requires a working authenticated session (CVSS vector PR:L), so anonymous attacks are not possible, and exposure is further narrowed because the orchestrator management plane is normally reachable only from admin or management networks. EPSS is 2.83% (85th percentile) with no public exploit code and no active exploitation reported, and while the vendor's CVSS 4.0 base score is 8.5, our independent assessment treats this as a moderate-priority rather than top-priority issue given the authentication prerequisite and the on-prem-only, restricted-reachability attack surface.
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by the client, bypassing certificate validation and enabling full traffic decryption and manipulation. This affects OTP versions 17.0 through prior to 27.3.4.15, 28.5.0.4, and 29.0.4. The vulnerability is resolved in patched releases; no active exploitation or public proof-of-concept is known at this time.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time.
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis.
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.
Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated attacker with a modified app on the adjacent network to connect to the robot while a legitimate operator is active. The attacker can intercept real-time video and send commands without alerting the legitimate user, compromising confidentiality and operational control. No active exploitation or public exploit code has been identified; a vendor patch is available.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposing its web administration interface and HTTP API - lets an unauthenticated attacker who is associated to the robot's own internal Wi-Fi network take full control of the platform (CWE-306). From that position the attacker can view live camera feeds, command movement, manage the GPS, RTK, SAM and LIDAR sensor suite, and issue critical operational commands including Play, Pause, Stop and E-Stop, resulting in complete loss of confidentiality, integrity and physical safety. Exploitation is bounded by the requirement to be within and joined to the robot's private Wi-Fi (CVSS 4.0 AV:A, PR:N, score 8.7), it is assessed as not automatable, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.19% (10th percentile), consistent with a technically severe but narrowly reachable flaw.
Privilege separation flaw in containerized-data-importer's view ClusterRole allows authenticated users with cluster-wide view permissions and write access to any namespace to clone and exfiltrate PersistentVolumeClaim (PVC) contents into a controlled namespace, bypassing namespace isolation and read-only guarantees. The vulnerability permits data theft across the cluster without requiring direct access to source namespaces.
Unauthenticated attackers can gain access to live video snapshots from CP PLUS EZ-P21 IP Camera (v4.8.8.1 and prior) by brute‐forcing the HTTP authentication endpoint. The vulnerability stems from a missing brute‐force protection mechanism, allowing remote password guessing without rate limiting or account lockout. Successful exploitation reveals high‐confidentiality video data. No active exploitation or public exploit code is known at this time.
Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Authentication bypass in the 微信二维码登陆 WordPress plugin through 1.3 allows unauthenticated attackers to log in as any existing user, including administrators, by forging webhook requests and intercepting leaked login codes. A publicly available proof-of-concept exists, the attack is fully automatable, and the technical impact is total, making this a critical priority for any site using the plugin.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Authenticated users in Leantime 3.6.2 and earlier can bypass project access controls to read milestone data from any project on the instance. By supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint, an attacker can enumerate and retrieve sensitive project planning information, including titles, descriptions, and timelines, without membership. A fix is available; exploitation details are public but no active exploitation has been reported.
Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to redirect or block push notifications to legitimate consoles. By supplying a known console asset identifier, an attacker can bypass authentication on the registration API to overwrite notification tokens and metadata, disrupting notification delivery. The issue is tracked as CVE-2026-66013; no public exploit is confirmed at time of analysis.
Unauthenticated remote administrator takeover in SiYuan before v3.7.2 via missing authorization on the /mcp kernel endpoint. When the Publish server is in anonymous mode, a remote attacker can invoke 31 MCP tools—including full file-system read, write, and delete—to exfiltrate secrets from conf/conf.json and plant a malicious plugin that runs with elevated desktop privileges. While no active exploitation has been confirmed by CISA KEV, detailed exploit information is publicly available, and the vulnerability carries a maximum CVSS severity.
Data zeroing attack in the Linux kernel's ksmbd SMB server allows an authenticated client to destroy file contents without requiring FILE_WRITE_DATA permission. A handle opened with only FILE_WRITE_ATTRIBUTES is sufficient to send FSCTL_SET_ZERO_DATA, bypassing the missing per-handle access check. Publicly available exploit code exists, and vendor patches have been released.
Authorization bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network client to rewrite any accessible file's security descriptor - including DACL and owner - without holding WRITE_DAC or WRITE_OWNER rights on the file handle. A client opening a handle with only FILE_WRITE_ATTRIBUTES can issue SMB2 SET_INFO with InfoType SMB2_O_INFO_SECURITY to invoke set_info_sec(), which rewrites POSIX ACLs, ownership via notify_change(), and (on KSMBD_SHARE_FLAG_ACL_XATTR shares) the Windows SD xattr, all without any fp->daccess gate. No public exploit has been identified; EPSS is 0.22%, and patches are confirmed in kernel stable series 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1.
Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.
Remote authentication bypass in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated attackers to gain full administrative access by submitting empty credentials. This enables control of power relays, device reboot, and network configuration, potentially causing physical equipment damage. No active exploitation or public exploit has been reported at this time.
Cloudreve versions earlier than 4.17.0 contain an incorrect authorization flaw in the OAuth scoping of admin storage policy routes. An attacker with a bearer token scoped only to Admin.Read can send a request to the vulnerable endpoint and overwrite OneDrive storage policy credentials, violating the intended scope boundary. A publicly available proof-of-concept exists, and the vendor has released a patched version.
Information disclosure in Microsoft Azure Portal allows a remote, unauthenticated attacker to access sensitive data they are not authorized to view by exploiting an improper authorization check (CWE-285) reachable over the network. The flaw affects the cloud-hosted Azure management console and, per its CVSS vector, requires no privileges or user interaction while yielding high confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the issue is assessed as automatable; the EPSS probability is modest at 1.03%.
Message content overwrite in Open WebUI's chat completion API allows any authenticated user to modify messages in channels they do not belong to, including private and DM channels. By crafting a request with a `channel:`-prefixed chat_id and a target message_id, an attacker can overwrite a message's content while retaining the original author attribution, effectively impersonating the victim. A publicly available proof-of-concept exploit exists, and the vulnerability affects versions 0.9.5 through 0.9.9.
Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt passwords of arbitrary vault accounts and store them in public links, enabling unauthenticated retrieval if the link hash is obtained. No active exploitation is confirmed, but public exploit code exists; EPSS probability is low (0.18%).
Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, overwrite passwords, and delete any account across the vault without per-account access controls. A public proof-of-concept is available, though EPSS indicates low exploitation probability (0.22%).
Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.
We are tasked to produce a JSON analysis for CVE-2026-66027 based on the provided data. The analysis must synthesize all the information, cross-reference, and produce a coherent summary, technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. We have: - CVE: CVE-2026-66027 - Description: broken access control in message queue API of Suna before 0.9.102, allowing authenticated attackers to access/manipulate other users' queue resources. Can read pending prompt queues, read/delete individual sessions, inject prompts into another user's session queue, causing background drainer to forward malicious messages to victim's running AI agent with victim's credentials. - CVSS Score: 8.7 (base score based on CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-862 (Missing Authorization) - Multi-source: EPSS 0.26% (percentile 17%) so low exploitation probability. POC/Exploit: Publicly available. Patch: Available from vendor. Reported by VulnCheck. - CPE: cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* (so product is Suna from kortix-ai). - Tags: Authentication Bypass, Suna - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. - ENISA EUVD ID confirms affected versions: suna 0 <0.9.102. So all versions before 0.9.102 are affected. - References: - exploit: https://github.com/geo-chen/oss/blob/main/suna.md (likely a writeup) - release: https://github.com/kortix-ai/suna/releases/tag/v0.9.102 - pull request: https://github.com/kortix-ai/suna/pull/4373 (security fix PR) - patch commit: https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a - vulncheck advisory: https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api - NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-66027
Complete cluster compromise via missing authentication in Microsoft Azure Kubernetes Service allows any unauthenticated remote attacker to gain administrative privileges over the network. No user interaction is required, and the vulnerability is automatable, enabling full cluster takeover with potential cross-tenant impact. No public exploit code or active exploitation has been reported, and a vendor patch is available.
Privilege escalation in Microsoft Azure App Service for Linux lets a remote, unauthenticated attacker bypass access controls and gain elevated privileges over the network, per Microsoft's MSRC advisory and a CVSS 9.8 rating. Because the underlying weakness is improper access control (CWE-284), a successful attack yields total confidentiality, integrity, and availability impact on the affected app-hosting environment. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CISA's SSVC assessment flags the flaw as automatable with total technical impact, and the modest EPSS score (0.81%) reflects an as-yet-unproven-but-realistic exploitation path.
Una
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
Privilege escalation and unauthorized data modification in the Grafana IRM cloud service allowed authenticated low-privilege users to perform operations on behalf of other users due to broken access controls, potentially leading to account takeover. The vulnerability affected cloud-only deployments of versions 1.0.0 through 1.164.0 and has been automatically resolved; self-hosted environments are not impacted. The EPSS exploitation probability is low (0.29%) and no active exploitation is known.
Privilege escalation via authorization bypass in EventON Action User for WordPress allows unauthenticated attackers to grant management and file-upload capabilities to any non-administrator role or user. The same endpoint also leaks user IDs, display names, capability states, and nonces, and lets attackers tamper with event-to-user assignments. No public exploit or active exploitation has been identified, but the vulnerability is trivially automatable.
Authorization bypass in Eclipse BaSyx Go Components through 1.0.0 lets unauthenticated network attackers reach ABAC-protected API handlers by appending a trailing slash to a route (e.g. GET /shells/ instead of GET /shells). The ABAC middleware evaluates the slashed path, finds no matching policy route, and passes the request onward, after which Chi's middleware.StripSlashes normalizes the path and executes the protected handler with no ABAC decision and none of the expected ABAC query filters. Publicly available upstream fix exists (PR #442, v1.0.1) and SSVC rates technical impact as total, though EPSS is low (0.35%) and no active exploitation is confirmed.
Unauthorized REST endpoint in WowOptin Popup Maker for WordPress (versions <1.4.38) allows unauthenticated attackers to disable all site opt-in forms and insert arbitrary template-based rows into the database. Public exploit code is available, though no active exploitation is reported. EPSS indicates a very low likelihood of widespread attack.
Unauthenticated SQL injection in the 'Project Management, Bug and Issue Tracking Plugin' for WordPress before version 5.1.0 enables remote attackers to extract or modify database contents via the standard front-end issue tracker. Exploit code is publicly available, and the vulnerability has a high CVSS score of 9.1, though EPSS probability remains low at 0.14%.
Privilege elevation in Microsoft Azure DNS lets a remote, unauthenticated attacker bypass authorization checks over the network to gain elevated permissions within the DNS service. The flaw stems from a missing authorization check (CWE-862) and carries a critical CVSS 9.8 with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS estimates a modest 0.67% 30-day exploitation probability, but CISA's SSVC framework flags the issue as automatable with total technical impact.
Authentication bypass in Microsoft Azure Key Vault lets a remote, unauthenticated attacker elevate privileges over the network and gain unauthorized access to the secrets, keys, and certificates the service protects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with full confidentiality, integrity, and availability impact. A vendor patch is available; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.70%, 49th percentile) despite CISA SSVC flagging the flaw as automatable with total technical impact.
Improper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication controls and tamper with data across a security boundary, with a maximum CVSS 3.1 base score of 10.0 driven by network reachability, no privileges required, and a scope change (S:C). Although the description emphasizes tampering (integrity), the CVSS vector rates confidentiality, integrity, and availability all High, indicating broad potential impact against Microsoft's multi-tenant cloud email service. No public exploit identified at time of analysis (E:U), and Microsoft has already deployed an official fix (RL:O) service-side.
Remote code execution in Microsoft Azure API Management (APIM) allows an authorized network attacker to achieve full system compromise via improper access control. The vulnerability (CWE-284) is tagged 'Authentication Bypass,' suggesting that despite requiring high privileges for initial entry, the flaw may allow an attacker to circumvent authorization boundaries within APIM and escalate to code execution. No public exploit has been identified at time of analysis, and SSVC confirms no current exploitation; however, the total technical impact (C:H/I:H/A:H) makes patching a priority for any organization running Azure API Management workloads.
Privilege escalation in Azure Red Hat OpenShift (ARO) lets an already-authenticated network attacker with limited rights (PR:L) bypass authorization controls (CWE-285) to gain elevated privileges with full confidentiality, integrity, and availability impact. Because the CVSS scope is changed (S:C), the compromise can extend beyond the initially authorized boundary into other components of the managed cluster or platform. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the 9.9 CVSS and SSVC 'total' technical impact make it a high-priority patch for any ARO tenant.
Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Zalando Skipper (all versions through 0.27.25) lets remote unauthenticated attackers evade Open Policy Agent body-content authorization by padding a request past the configured maxBodyBytes limit. Because Skipper forwards the oversized payload upstream while handing OPA an empty parsed_body, deny-on-presence Rego policies fail open and forbidden actions execute. This is an incomplete fix for CVE-2026-50197; publicly available exploit code exists (docker-compose PoC in the GHSA advisory), but there is no public evidence of active exploitation and no code-level fix - v0.27.26 only adds documentation.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote unauthenticated attackers defeat identity verification and gain full control over the managed file transfer server. Because MOVEit is a high-value data-exchange gateway, a successful bypass exposes all hosted files and administrative functions. No public exploit identified at time of analysis, and EPSS probability is low (0.18%, 8th percentile) despite the 9.8 CVSS, reflecting no observed exploitation yet.
Unauthenticated arbitrary blob creation in Chatwoot before 4.16.0 lets remote attackers abuse the ActiveStorage direct-uploads controller, which lacks authentication (CWE-306), to resolve any tenant's account and conversation and obtain signed PUT URLs for writing attacker-controlled data into the shared storage backend. The flaw affects all self-hosted and multi-tenant Chatwoot deployments prior to 4.16.0, is reported by VulnCheck, and has publicly available exploit code exists (no CISA KEV listing). The CVSS 4.0 vector emphasizes integrity impact (VI:H) with a secondary availability effect (VA:L) and no confidentiality loss.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Cross-tenant privilege abuse in CyberPanel through 1.9.1 lets any authenticated panel user read, delete, or restore other tenants' incremental backups by supplying a guessed IncJob integer ID that the IncBackups handlers never re-scope to the caller's own domain. The flaw affects the deleteBackup, fetchRestorePoints, and restorePoint endpoints; because IncJob IDs are globally sequential, an attacker can trivially enumerate victims, and unauthorized restores execute with root privileges. No public exploit identified at time of analysis, but the root cause and fix are fully disclosed in vendor commit b198460.