Authentication Bypass
Monthly
Missing authentication in the FastAPI backend of Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1 and 0.3.2) lets unauthenticated remote attackers reach API endpoints that should require credentials, because the dependency logic in backend/app/dependencies.py does not enforce an authentication check. The CVSS 4.0 base score is 6.9, and the vector (AV:N/AC:L/AT:N/PR:N/UI:N, LOW confidentiality/integrity/availability) indicates no credentials, no user interaction and no special conditions are needed; no public exploit code is identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Real-world priority remains low because the software is an obscure self-hosted hobby project, so exposure depends on someone operating a publicly reachable instance, and a successful bypass yields only LOW impact across all three security objectives.
Process Compose before 1.120.0 exposes its MCP SSE listener on loopback without validating the Host or Origin header or authenticating the caller, allowing a malicious website to reach that listener through DNS rebinding and issue MCP requests. Unauthenticated remote attackers (CVSS 4.0 PR:N, UI:P) can, when expose_control_tools is enabled, enumerate process state, read, search or truncate logs, and start, stop, restart or scale local processes; user-defined tools may expose further commands and output. Publicly available exploit code exists (SSVC Exploitation: poc), no active exploitation is confirmed (no CISA KEV listing), and the issue is fixed in 1.120.0.
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. It carries a low CVSS base score of 3.5, no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the available intelligence.
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. Severity is low - the vendor-published CVSS 4.0 base score is 2.3 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) and our independent assessment scores it CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - because exploitation demands LAN adjacency plus an unspecified device-state prerequisite and the immediate consequence is limited to enabling further access rather than full compromise.
Bransys ELD ships with hardcoded MQTT credentials that allow unauthenticated remote attackers to subscribe to the real-time telematics feed for every active device belonging to the subset of carriers that were connected to the affected MQTT broker. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the weakness is remotely reachable, low complexity, and requires no authentication or user interaction, but confines impact to low confidentiality - read-only exposure of real-time data with no integrity or availability effect, consistent with the vendor-side CVSS 4.0 score of 6.9 (VC:L, VI:N, VA:N). No public exploit code has been identified at time of analysis, though the hardcoded-credential nature of the flaw means anyone who extracts the static string from firmware or a decompiled mobile/app binary can reuse it without further tooling; practical exposure is bounded by whether the broker stays network-reachable and still accepts the unchanged credentials.
Improper authentication in the password-change handler of gedelumbung HospitalManagement allows an authenticated low-privilege user to tamper with another account's credentials by manipulating the kode_user/username argument passed to the simpan actions in application/modules/global/controllers/password.php and profil.php. The flaw is network-reachable, requires no victim interaction (CVSS:4.0 AV:N/AC:L/PR:L/UI:N) and yields partial confidentiality, integrity and availability impact (VC:L/VI:L/VA:L), consistent with the 5.3 base score; because the identifier is not bound to the caller's session, an attacker holding any valid account can target other users' password/profile records. Publicly available exploit code exists - the disclosure was filed as a public GitHub issue against the project - but there is no indication of confirmed active exploitation, and the maintainer has not responded or published a fix.
IBM Controller 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 permit an authenticated low-privilege user to bypass file-size validation by tampering with client-side input, producing low integrity and availability impact without confidentiality exposure. The issue is rated CVSS 5.4 and assessed as a moderate, not a priority, issue; no public exploit identified at time of analysis. A vendor patch is available per IBM advisory, and exploitation requires a valid IBM Controller account with network access.
This is a real but moderate-priority vulnerability whose severity depends almost entirely on deployment topology rather than the raw 6.5 CVSS score. Netty's HTTP decoder lets split or duplicated Transfer-Encoding header fields slip past its final-chunked validation, so an unauthenticated, remote attacker who can send a raw crafted request to a Netty listener that sits in an HTTP chain with a second HTTP parser (reverse proxy, load balancer, CDN, WAF, or upstream/downstream server) can desynchronize the two parsers and smuggle a request (CWE-444). Impact is confined to low confidentiality and integrity loss (C:L/I:L) with no availability impact, no authentication (PR:N) or user interaction (UI:N) is required, and no public exploit identified at time of analysis.
Parameter substitution in the Elytron token-realm of Red Hat JBoss EAP 7, JBoss EAP 8 and the EAP Expansion Pack allows a remote attacker to manipulate OAuth2 token-introspection requests because parameters are assembled without URL encoding. Only deployments whose application security domain is backed by a token-realm configured with oauth2-introspection are exposed; other realm types (properties, JDBC, LDAP, or JWT validation without introspection) are unaffected, and the achievable impact is limited to Low confidentiality and Low integrity with no availability impact. Vendor scoring is 4.2 on an AC:H basis because success hinges on how the downstream introspection endpoint parses the injected parameters, and no public exploit has been identified at time of analysis.
Sandbox escape in vm2 through 3.12.0 lets untrusted guest code cross the NodeVM isolation boundary and change process-wide state by calling crypto.setFips(), which toggles the FIPS mode of the entire host Node.js process (observed as crypto.getFips() flipping from 0 to 1 in the reporter's test). The vulnerability is only reachable when the embedding application runs vm2 as a NodeVM with the non-default, opt-in configuration require.builtin: ['crypto']; authentication and user interaction are not required in that scenario, and the practical impact is limited to low-integrity and low-availability effects rather than arbitrary host code execution or data disclosure. No public exploit identified at time of analysis; the issue is fixed in vm2 3.12.1, available from the vendor (GHSA-x3v6-43hc-82mc).
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct sustained brute-force attacks against the login interface, potentially leading to unauthorized system access. The vulnerability (CWE-307) is remotely exploitable without authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), but success is limited to weak, reused, or guessable credentials and is effectively mitigated by MFA, rate-limiting, IP throttling, or strong password policies. No public exploit identified at time of analysis, and active exploitation has not been confirmed (not in CISA KEV).
Certificate revocation validation performed by Netty's optional netty-handler-ssl-ocsp module can be silently skipped when the OCSP response omits the optional nextUpdate field, causing the application to proceed with a certificate that should have been rejected. The flaw is remote and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), but exploitation is conditional: the deployment must actually use the opt-in OCSP-stapling component, and the attacker must control or intercept the OCSP response seen by the client, typically through a man-in-the-middle position or by operating the TLS server whose certificate is being validated. There is no public exploit identified at time of analysis and no KEV listing, and the practical impact is confined to acceptance of a revoked or otherwise unvalidated certificate rather than code execution or data disclosure.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Missing authorization checks in the Foxtool All-in-One plugin for WordPress (all versions up to and including 2.5.3) allow any authenticated subscriber-level user to modify arbitrary subkeys of the plugin's foxtool_settings option, including the media-up3 toggle that enables site-wide SVG uploads - a change that can be chained into stored cross-site scripting through a malicious SVG file rendered by a victim. The settings modification itself is unauthenticated only in the sense that no additional user interaction is required once a low-privileged account exists; exploitation therefore matters mainly on sites with open registration or untrusted subscriber accounts. Real-world risk is moderate-to-low: the direct impact is a limited integrity violation (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the XSS escalation is conditional on a second step, and no public exploit code or active exploitation was identified at time of analysis.
Bypass of the registration CAPTCHA in the WordPress Clean Login plugin before 1.19 allows unauthenticated attackers to create accounts without solving the challenge when the stored session value is empty. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) was reported, and our independent assessment rates this as a genuine low-to-moderate priority issue because the impact is limited to spam and automation abuse rather than compromise of existing accounts or the server. The vendor has released version 1.19 as the fixed release.
The Clean Login WordPress plugin before 1.19 lets unauthenticated attackers create user accounts on sites where registration is disabled, bypassing an administrative control intended to prevent open sign-ups. The registration handler fails to check the site's registration-enabled setting, so even locked-down sites become vulnerable; impact is limited to unauthorized low-privilege account creation (CVSS I:L) with no direct confidentiality or availability loss. Publicly available exploit code exists, and the vendor has released a patched version (1.19).
Unauthenticated attackers can create WordPress user accounts on sites running the Easy Form Builder by WhiteStudio plugin in versions 4.0.0 through before 4.2.0, even when the site owner has deliberately disabled user registration. The plugin fails to validate a submitted value against its stored configuration for certain form types (CWE-284, improper access control), so the registration-disabled setting is bypassed via a remote, unauthenticated request requiring no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3). Publicly available exploit code exists for this issue, but it is not confirmed as actively exploited (not in CISA KEV); the realistic impact is bounded by the site's default new-user role, typically Subscriber, and updating to 4.2.0 fully removes the flaw.
Cross-user lock manipulation in the Nextcloud Files Lock (files_lock) app allows any authenticated user to lock or unlock files they do not own by supplying the absolute WebDAV path of another user's file, because the DAV plugin resolves the request URI without confirming that the path belongs to the session user. An attacker who can enumerate or guess a victim's path can block editor saves and PUT/MOVE/DELETE writes, and can also have the application hand back the victim's lock token, which enables removal of token-based client locks. Rated 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in the authoritative assessment, it requires a valid account and an enabled files_lock app on a multi-user instance; impact is limited to denial-of-write and lock-token disclosure with no file content read/write or code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis.
CubeCart versions prior to 6.7.5 contain a broken access-control flaw in the admin order-note deletion handler (admin/sources/orders.index.inc.php), allowing an authenticated administrator who lacks the CC_PERM_DELETE order-modification privilege to delete records from the CubeCart_order_notes table with a single crafted request. The handler only checks that order_id and delete-note parameters are present, so back-office staff with restricted roles can erase order-history and audit-trail notes. No public exploit identified at time of analysis; the CVSS 5.4 score reflects limited integrity and availability impact confined to note deletion, not broader data disclosure or code execution.
Unauthenticated attackers can read unpublished car listings belonging to any user on WordPress sites running the Motors - Car Dealership & Classified Listings plugin through version 1.4.120, because the mvl_ajax_dealer_load_cars() AJAX handler performs no authorization or ownership check on the requested listings. The exposure is limited to confidentiality (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - draft, pending, private, and scheduled 'future' listings can be enumerated and retrieved, but no data can be modified and no denial of service results. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; independent assessment rates this a genuine but modest-severity issue rather than a high-priority emergency, so the practical concern is information disclosure of pre-publication dealer inventory and any sensitive details held in those listings.
Unauthenticated attackers can create fully approved appointment and event bookings without completing payment in the WordPress plugin 'Booking for Appointments and Events Calendar - Amelia' in all versions up to and including 2.4.5. The plugin trusts a client-supplied package-redemption identifier as proof of payment and never validates it server-side, so forging that value is enough to mark a booking as paid and confirmed, a business-logic/authorization weakness (CWE-862) scored CVSS 5.3 (integrity-low, no confidentiality or availability impact). Exploitation is limited to fraudulent booking creation and calendar-slot consumption, and sites that do not sell paid packages or appointments have minimal practical exposure; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV).
Broken access control in the WordPress booking plugin 'Booking for Appointments and Events Calendar - Amelia' (Premium edition, versions up to and including 2.4.4) allows an authenticated attacker holding the wpamelia-provider role to read and modify any customer record through the /users/customers/<id> endpoint, including triggering a customer password reset, because the handler never verifies that the requesting provider owns the targeted customer. The same missing ownership check can be chained to take over a linked WordPress account with a role as high as Editor, but only where that WordPress user has previously made an Amelia booking; free-version installs are unaffected because the Employee Panel does not exist there. Per the CVSS vector (PR:L) exploitation requires an authenticated account with the provider role, scoring 5.4 overall, and no public exploit identified at time of analysis - no CISA KEV listing and no published PoC or EPSS signal was present in the supplied intelligence.
Caddy Proxy Manager releases prior to 1.5.1 ship with email/password self-registration enabled by default at /api/auth/sign-up/email, so unauthenticated remote attackers can create an active account without any administrator approval step (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). The resulting account is assigned only the low-privilege 'user' role, which cannot view or modify proxy configurations or certificates, so the practical impact is limited to unauthorized account creation and a potential foothold rather than administrative compromise. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; version 1.5.1 fixes the insecure default by requiring the operator to set AUTH_ALLOW_SELF_REGISTRATION=true before sign-up is permitted.
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. The flaw affects C Driver 2.0.0 through versions before 2.3.2, and the vendor explicitly notes TLS mitigates it, so standard TLS-protected production deployments are not exploitable; no public exploit code was identified at time of analysis. The vendor/ENISA CVSS 4.0 base score is 6.3, while our independent assessment (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) rates real-world risk moderate-to-low because exploitation requires both a man-in-the-middle position and an unencrypted or TLS-stripped MongoDB connection, and the payoff is only a captured proof that must still be cracked.
Missing authorization in the mayfly-go AI Assistant (server/internal/ai/api/ai.go) allows an authenticated user - authenticated, per CVSS PR:L - to execute compound shell commands without a genuine approval gate; the command whitelist is only one token wide, so any chained command containing curl, wget, or sed auto-runs, and approval can be self-granted by the same session user. All versions up to and including 1.11.5 are affected, and publicly available exploit code exists (a gist PoC is referenced); the issue is not listed in CISA KEV, so there is no confirmation of active exploitation. This is a low-priority issue by every available signal: the vendor-assigned CVSS 4.0 base score is 2.1, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and CISA's SSVC decision framework rates exploitation as 'poc', automatable as 'no', and technical impact as 'partial'. The practical effect is a bounded policy bypass enabling unapproved command execution within a legitimate user's existing privileges, not a privilege-escalation or full-compromise primitive.
Missing space-membership authorization checks in Scoold prior to 1.69.0 let any authenticated user write replies and comments into question threads belonging to private spaces they are not members of, resulting in unauthorized modification of private discussions. The flaw only manifests in the non-default configuration where scoold.is_default_space_public is set to false and private spaces are actually in use, and it requires a valid session plus knowledge (or enumeration) of a target question identifier; the attacker gains write access only, not read access, to the affected thread. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5), exploitation is authenticated and integrity-only, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the vendor-released fix is version 1.69.0.
Scoold deployments prior to 1.69.0 expose replies to questions in private spaces through the answers API: a holder of a valid personal API token can call GET /api/posts/{id}/answers and receive the reply bodies of a private-space question whose own endpoint correctly denies access. The flaw affects instances configured with both scoold.api_enabled and scoold.api_user_access_enabled set to true, and exploitation additionally requires the attacker to know or enumerate the target question's identifier, so it is a confidentiality-only (C:H, no I/A) disclosure of existing private discussion content rated 6.5. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the vendor has released a fix in 1.69.0.
Broken per-user authorization in WireGuard Portal (wg-portal) versions 2.2.0 through 2.2.x allows an authenticated low-privilege user to enumerate other users' peer public keys and monitor their BytesReceived/BytesTransmitted counters by connecting to the statistics WebSocket at /api/v0/ws. The same endpoint also exposes administrator-only interface names and interface statistics, though tunnel content, AllowedIPs, and user identities remain authorization-gated; the issue is fixed in version 2.3.0. No public exploit code identified at time of analysis, and the impact is limited to information disclosure on multi-user instances.
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace existing files on disk that are owned by another package or unmanaged by mport, compromising local filesystem integrity and package database consistency. The flaw requires user interaction (UI:P) and specific attack requirements (AT:P), and is unauthenticated according to the CVSS vector (PR:N). No public exploit was identified at time of analysis; the vendor fixed the issue in version 2.7.8.
Mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.8 through 3.0.11 allows a man-in-the-middle who cannot prove knowledge of the shared secret to be accepted as a legitimate server when SCRAM-SHA-256 or Digest mutual authentication is used over a non-TLS or already-compromised transport. The affected interceptor methods computed the SCRAM ServerSignature or Digest rspauth verification value but only logged a mismatch and still delivered the response to the application as authenticated, so the client silently loses its only signal that the peer is an impostor. Over TLS the flaw is inert because a genuine server always returns a valid verification value; exploitation requires a MITM position (AC:H), the impact is limited to authentication-assurance loss (C:N/I:L/A:N), and no public exploit code or active exploitation has been identified at time of analysis. Fixed in version 3.0.12.
In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smack_msg_queue_msgrcv The smack_msg_queue_msgrcv() function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd() syscall path, if a receiver is already waiting, the pipelined_send() optimization is used to push the message directly to the receiver task: ipc/msg.c`pipelined_send(): ` smp_store_release(&msr->r_msg, msg) In this case, the 'sender' (current) task performs the check on behalf of the 'receiver' task (msr->r_tsk, passed as the 'target' parameter): ipc/msg.c`pipelined_send(): ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,) However, smack_msg_queue_msgrcv() ignores the 'target' and checks 'current': smack_msg_queue_msgrcv(…) ` smk_curacc_msq(isp, MAY_READWRITE); // current task 'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement, but 'target' (the receiver task) might NOT; as a result, an unauthorized receiver gets the message, violating MAC policy. Test: 1) create a sysv message queue with label “foo” 2) echo "bar foo r" >/smack/load2 3) msgrcv(,,,0,MSG_NOERROR) in "bar"-labeled task. The task is waiting for the messages ... 4) msgsnd() from a "foo"-labeled task: "bar"-labeled task gets the message. This patch fixes the issue by checking permission on the 'target' task instead of 'current'. (2008-02-04, Casey Schaufler)
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If either calls to ->iomap_end() or ->iomap_begin() fail, the direct return paths bypass the batch cleanup. The ->iomap_end() case is not a practical issue at the moment because there is no user of the mechanism that returns an error from this path. The ->iomap_begin() case is theoretically possible because XFS can invoke the fill helper and error out at various points thereafter. This subtly complicates things because XFS does not transfer iomap_flags to the iomap data structure in the error path. To deal with both of these issues, first make sure to invoke the cleanup helper in the error path for either fs callback. Second, update the helper to clear the flag unconditionally and release the batch so long as it is populated. This more clearly delineates the purpose of the flag to control the I/O path and not necessarily the status of the fbatch, so add a comment around this as well.
In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size. If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged. Use hugepage_put_subpool() on the failure path, matching the normal put_super path.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_put_stid() releases the svc_export tracked in nfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and lock stateids by calling ->sc_free() directly, bypassing that path. An open stateid takes an sc_export reference in nfs4_open() and a lock stateid takes its own in init_lock_stateid(); both reach free_ol_stateid_reaplist() through their normal teardown, the open stateid via release_open_stateid() and the lock stateid via nfsd4_release_lockowner(), each through put_ol_stateid_locked(). The reference is therefore never dropped, pinning the export and blocking unmount for the lifetime of the stateid. Release sc_export in free_ol_stateid_reaplist() the way nfs4_put_stid() does. ->sc_free() runs once per stateid, and a stateid reaches free_ol_stateid_reaplist() or nfs4_put_stid() but never both, so the reference is dropped exactly once. Revoked stateids reach this path with sc_export already cleared by drop_stid_export(), so they are skipped rather than double-freed. nfs4_put_stid() itself read sc_export before acquiring cl_lock. drop_stid_export() clears that field and releases the reference under cl_lock, so a concurrent revocation could drop the export in the window between the read and the final put, releasing the same reference twice. Read sc_export while cl_lock is held so the two paths serialize and the reference is released exactly once.
Authentication bypass in Steeltoe.Security.Authorization.Certificate (Steeltoe prior to 4.3.0) lets remote unauthenticated attackers spoof the X-Client-Cert header to defeat the SameOrg and SameSpace authorization policies, gaining access to resources belonging to another organization or space. The flaw is that AddOrgAndSpacePolicies() combined with UseCertificateAuthorization() trusts a client-supplied public certificate without verifying proof of possession of the matching private key, and common Cloud Foundry routers pass the header through to the application. Exploitation is unauthenticated (PR:N) but high complexity (AC:H) and only succeeds when ingress does not restrict inbound traffic to a known trusted proxy source IP and the attacker already holds the public certificate of an application instance in the target org or space; there is no public exploit code and no CISA KEV entry, and EPSS data was not provided, so the practical risk is moderate and deployment-dependent. Fixed in Steeltoe 4.3.0.
BMCtest's test harness starts an Ironic bare-metal provisioning service without authentication or TLS, letting an attacker on the adjacent network modify node and provisioning state through the unauthenticated Ironic API for as long as the test is running. Exploitation is heavily constrained by a timing race: the unprotected Ironic instance exists only during an active bmctest run, and the attacker must reach the API before the harness tears it down, which is why the CVSS vector carries AC:H and the overall score is only 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity-only impact). No public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the CWE-306 missing-authentication framing.
Sandbox escape and read-only bypass in vm2 3.9.6 through 3.11.6 lets untrusted JavaScript running inside a NodeVM defeat the vm.freeze() and vm.readonly() protections and mutate host object properties that the embedder explicitly marked immutable. An attacker uses Object.getOwnPropertyDescriptor() or __lookupSetter__() to recover host-realm setters from accessor properties on frozen objects and invoke them directly, circumventing the Proxy-based restrictions. The CVSS 4.0 vector (PR:N, AC:H, AT:P, VI:L/SI:L, no C/I/A beyond low integrity) confirms unauthenticated access but high attack complexity and an integrity-only ceiling with no code execution; two prerequisites must hold (untrusted code executed in vm2, and reliance on vm.freeze()/vm.readonly() to protect reachable host objects). No public exploit identified at time of analysis, there is no CISA KEV listing, and vm2 is deprecated, which further narrows realistic exposure to legacy deployments using versions 3.9.6 to 3.11.6.
Unauthenticated broken access control in the BerqWP WordPress plugin (versions up to and including 4.1.15) lets remote attackers reach functionality that should require authorization, resulting in limited unauthorized modification of site state with no data disclosure or denial of service (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Any WordPress site running an affected version of this niche caching/performance plugin is exposed, though the impact ceiling is low-integrity changes rather than code execution or data theft. There is no public exploit identified at time of analysis, and no CISA KEV entry; the practical risk is bounded by the plugin's small install footprint and the sub-score-only integrity impact.
Unauthenticated information disclosure affects the WordPress plugin User Registration (WPEverest) at versions 5.2.7 and earlier, where a missing authorization check lets remote visitors reach data that should require higher privileges. The assessed CVSS vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the issue is remotely reachable with no credentials and no user interaction, but impact is bounded to confidentiality - there is no evidence of data modification or full account takeover. At time of analysis there is no CISA KEV listing and no public exploit identified; the 'Authentication Bypass' tag should be read in the narrow sense of unauthorized data access rather than a complete authentication defeat.
Unauthenticated broken access control in the WordPress plugin Booking Calendar (wpdevelop) at version 11.7 and earlier lets remote attackers invoke booking-related functionality that should require authorization, with no credentials and no user interaction required. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), impact is limited to low integrity - unauthorized actions or manipulation within the plugin's booking data - with no confidentiality or availability effect, so this is a genuine but modest-priority issue. Exploitation is constrained only by the target running an unpatched copy of this specific plugin; no public exploit code has been identified and the issue is not confirmed actively exploited (not in CISA KEV) at time of analysis. Reported by Patchstack and tracked as EUVD-2026-81515.
Broken access control in the Simple Membership WordPress plugin (versions up to 4.8.2) allows an authenticated Contributor-level user to perform unauthorized integrity-affecting actions, such as modifying membership settings or data, without requiring user interaction. The vulnerability is remotely reachable with low complexity (CVSS 5.3), but its impact is limited to low integrity loss with no confidentiality or availability impact, making it a modest risk despite the network vector. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the advisory's CVSS vector lists PR:N while the title specifies a Contributor prerequisite, a discrepancy to confirm via Patchstack.
Authorization bypass in the Cooked WordPress plugin through version 1.16.0 allows an authenticated user holding only Contributor-level privileges to manipulate objects belonging to other users by supplying an unauthorized object identifier. The flaw is remote and requires no victim interaction, but it is gated behind a mandatory low-privilege account, which the independent assessment classifies as a genuine yet moderate-priority authorization defect rather than a critical one. Impact is limited to low integrity and low availability effects with no confidentiality exposure per the assessed vector (CVSS 5.4), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can access sensitive information from WordPress sites running the Easy Invoice plugin versions up to and including 2.3.8 due to a missing authorization check (CWE-862). The vulnerability requires only network access to the target site and results in partial confidentiality impact (CVSS 5.3), with no data modification or denial of service. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated insecure direct object reference (IDOR) in the King Addons for Elementor WordPress plugin at versions up to and including 51.1.81 lets remote attackers manipulate objects belonging to other users or site roles by supplying a crafted object identifier to an affected endpoint, with no authentication or user interaction required (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). Impact is deliberately narrow: only Low integrity is affected (I:L), with no confidentiality or availability loss and no scope change, so the practical worst case is unauthorized modification of a single object rather than data theft or site takeover. No public exploit has been identified at time of analysis, and the issue is reported through Patchstack; no vendor-released fixed version is published as of this assessment, so mitigation currently depends on virtual patching or deactivating the plugin.
Local denial of service in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an unauthenticated attacker with local access to crash or degrade the OMSA agent by exploiting a missing authentication check on a critical function. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms the attack requires local access and no privileges, but impact is limited to partial availability loss with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE; the risk is confined to environments where untrusted or low-privilege users can run code locally on managed Dell servers.
Local attackers holding a low-privileged workload on an Eclipse Ankaios agent can bypass log-access authorization to read other workloads' logs on the same agent. The flaw affects Eclipse Ankaios 0.6.0 through 1.0.3, where the agent's control-interface authorizer stops evaluating a rule at the first wildcard pattern and therefore skips later deny LogRule entries; exploitation requires a rule set in which a wildcard-containing entry precedes a deny rule. This is a low-severity authorization flaw (CVSS 4.8, CWE-863) requiring local access and an existing workload foothold, with no public exploit identified at time of analysis.
Logout revocation bypass in SUSE NeuVector lets an authenticated holder of a valid, unexpired NeuVector JWT keep using that token after logout by re-encoding the RSA signature field with a noncanonical-but-equivalent Base64URL spelling, which no longer matches the exact-string logout/revocation blocklist while still passing signature verification. The issue is remotely reachable (AV:N) but requires a previously issued token (PR:L) and non-trivial crafting of an equivalent encoding (AC:H), and the exposure window is strictly bounded by the original token's remaining validity and its original scope, with only partial confidentiality and integrity impact and no availability impact. This is CWE-863 incorrect authorization; no public exploit code identified at time of analysis.
Local authentication bypass in the Acer System Monitoring component bundled with NitroSense (Nitro laptops) and PredatorSense (Predator laptops) lets any user who already holds a session or code execution on the machine open a WebSocket connection to the monitoring service without supplying credentials, because the handshake never performs an authentication check (CWE-306). Exploitation is constrained to the local attack vector (AV:L) and requires the component to be installed and running; it is not remotely reachable, the vendor's own description hedges with 'under certain circumstances', and the exploit is unproven (E:U). Impact is confined to Low confidentiality, integrity, and availability effects on service functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis, making this a low-priority issue by every available signal.
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated WordPress user with Contributor-level access or above on sites running the Event Booking Manager for WooCommerce plugin in versions 5.3.6 up to but not including 5.6.0. The plugin fails to enforce a capability check on the code that renders its stored gateway configuration, so a low-privilege author account can retrieve secrets intended only for administrators; publicly available exploit code exists, and the vendor has released a fix in 5.6.0. The practical risk is moderate rather than critical because a valid Contributor account is required and the plugin must have PayPal and/or Stripe credentials configured, but any site that allows Contributor self-registration or has many low-trust authors should treat the exposure as urgent and rotate keys immediately.
Unauthenticated remote attackers can read any author's non-published car listings - including titles, prices, media URLs and seller notes - from WordPress sites running the Motors plugin before version 1.4.121, simply by supplying the target's numeric WordPress user ID, because the endpoint that serves draft, pending and private listings performs no authorization check (CWE-639). The issue carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a read-only confidentiality impact with no authentication, user interaction, or non-default configuration required; publicly available exploit code exists per WPScan, and no CISA KEV entry confirms active exploitation. Impact is bounded to information disclosure of unpublished listing data - no integrity or availability effect - but the exposed fields (pricing strategy, unpublished media, seller notes) can be commercially sensitive and facilitate competitive or social-engineering reconnaissance.
Unauthenticated remote attackers can disable any Popup Builder popup on WordPress sites running Master Addons for Elementor versions 3.0.0 through before 3.1.9, because the plugin's AJAX popup-deactivation action performs no authorization check and relies solely on a nonce that is exposed to every visitor. Publicly available exploit code exists, but the impact is deliberately narrow: only the integrity of the popup feature (CWE-862 missing authorization, CVSS 5.3 with I:L) is affected, there is no data disclosure or code execution, and an administrator can undo the change by re-enabling the popup. The vendor has released a patch in version 3.1.9, and the issue is not listed in CISA KEV.
Any authenticated WordPress user - including a subscriber with no elevated privileges - can permanently delete every stored form submission in versions of the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' plugin prior to 5.1.1, because the plugin's message-deletion AJAX action performs no capability check and merely tests that a nonce parameter is present rather than validating it. The attack is network-reachable, needs no user interaction and no valid nonce, and publicly available exploit code exists, so the practical barrier is simply holding any low-privilege account (for example, via open registration). This is a genuine but moderate-priority integrity issue rather than an inflated critical finding: the assessed vector rates integrity impact as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, consistent with a full wipe of stored submission data), but there is no confidentiality or availability impact and no confirmed active exploitation at time of analysis.
Missing signature enforcement in the Autopay WordPress payment-gateway plugin before 5.0.1 lets unauthenticated remote attackers disclose and delete the stored payment parameters of other customers' orders through the plugin's payment callback endpoint (CVSS 6.5, CWE-863). The assessed vector AV:N/AC:L/PR:N/UI:N confirms exploitation needs no authentication or user interaction - only network reachability to the callback plus knowledge or enumeration of target order identifiers - and publicly available exploit code exists, although there is no confirmed active exploitation. Impact is scoped to disclosure and deletion of stored payment parameters rather than full site compromise, and real-world exposure is limited by the plugin's niche, largely Polish-market footprint.
Local unauthenticated access to the Acer Agent Service - the background component shipped with Acer's NitroSense and PredatorSense utilities on Nitro and Predator Windows laptops - allows any user or piece of malware already running on the host to open a connection to the service socket and reach functionality that should be restricted, because the socket handshake never verifies the caller's identity (CWE-306). Rated CVSS 4.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H) and scored by our assessment as CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, the flaw is not remotely reachable and requires the Acer software to be installed, with the vendor description noting the unauthenticated handshake path succeeds only 'under certain circumstances.' No public exploit has been identified at time of analysis, and the practical exposure is a local privilege/functionality boundary bypass rather than an internet-facing emergency.
Local attackers with access to an Acer Nitro or Predator laptop can recover a hard-coded AES key used by the Acer Agent Service, a component bundled with NitroSense and PredatorSense, allowing access to protected information or unauthorized actions. The vulnerability is rated CVSS 4.9 and is not known to be actively exploited; no public exploit was identified at time of analysis, and the vendor marks exploit maturity as Unproven. Because the key is identical across installations, any local copy of the affected software can expose it.
Non-atomic rate-limit counter increments in AVideo through 29.0 let remote unauthenticated attackers bypass the platform's documented 30-attempts-per-5-minute login throttle simply by firing genuinely concurrent credential guesses, multiplying their effective attempt rate by their connection concurrency. The weakness only degrades a protective control, so abuse still requires a brute-forceable account (weak or guessable password, no MFA, and no independent account lockout), which keeps this a moderate, defense-in-depth issue rather than a critical priority. No public exploit code has been identified at time of analysis, and the assigned CVSS 4.0 base score is 6.9 for low confidentiality and integrity impact to the vulnerable system.
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified because the otlploggrpc exporter reads TLS certificate settings from environment variables into its config but never applies them to the gRPC transport credentials. When TLS is configured only through OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and the related client-certificate/key variables - and the application does not additionally call WithTLSCredentials in code - the client falls back to credentials.NewTLS with system roots and no client certificate, so the intended private-CA pinning and mutual TLS are bypassed. A network attacker in a man-in-the-middle position who can present a certificate chaining to the victim host's system trust store can read or alter exported log data; misconfigured code paths that do pass WithTLSCredentials are unaffected, the system-trusted-certificate prerequisite is a significant limiting factor, and no public exploit was identified at time of analysis. The issue is fixed in otlploggrpc v0.21.0.
Unauthenticated users can download translated files from LibreTranslate deployments running version 1.9.6 or earlier because the download_file route is missing the access_check decorator, letting requests bypass the API key requirement and ban-list enforcement that operators configured for protected instances (CWE-862 missing authorization). Impact is limited to reading translated file output with no integrity or availability effect, and practical exposure depends on whether download identifiers are predictable or enumerable by the attacker. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS v4.0 base score of 6.9 reflects unauthenticated network reachability combined with low confidentiality impact.
Guest-level users on kan through 0.6.0 can create boards they are not entitled to create by invoking the GitHub project import mutation, which never applies the board:create permission check that the normal board-creation path enforces. The impact is an authenticated, integrity-only authorization bypass (assessed CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/C:N/I:L/A:N) that requires the attacker to already hold a low-privilege account on the target instance; there is no disclosure of other users' data and no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so this is a genuine but low-severity permission-model defect rather than an emergency.
Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.
Organization-scoped API tokens in OpenCVE before 3.1.0 can list and retrieve every organization belonging to the token creator because the organizations API endpoint ignores the token's organization scope. This is a low-severity confidentiality-only broken-access-control flaw (CWE-863); exploitation requires a valid organization-scoped token (authenticated, PR:L) whose creator belongs to multiple organizations, and it yields no extra data in single-organization deployments. No public exploit identified at time of analysis; vendor-released patch: 3.1.0.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Missing server-side validation of administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) lets an authenticated, remote administrative user modify configuration content that should be gated behind a higher privilege level, specifically the descriptions of files on one particular page. Only ISE deployments exposing the management interface to a reachable network are affected, and exploitation requires a valid administrative credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so confidentiality and availability are untouched and only a narrow integrity element is at risk. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS signal was not provided; despite the 'Authentication Bypass' tag attached to this record by some feeds, the flaw is an authorization-enforcement gap rather than a way to authenticate without credentials.
Missing per-role authorization checks in the CommPilot web-based management interface of Cisco BroadWorks allow an authenticated, low-privilege remote user to alter configurations on select administrative pages via a crafted HTTP request. The issue (CVE-2026-76438, CWE-863, CVSS 6.5 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affects BroadWorks releases 21.0 through 26.0, including the 21.sp1 line and assorted RI builds, with the assessed impact limited to configuration integrity - no confidentiality or availability loss per the vector. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a routine, patch-priority access-control defect rather than an emergency: a valid low-privilege CommPilot account is a prerequisite, and BroadWorks management interfaces are normally confined to carrier or management networks.
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. Impact is limited to confidentiality (C:H, no integrity or availability effect, CVSS 4.9 / PR:H), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but tightly-gated confidentiality issue rather than a broad emergency, and should be prioritized behind perimeter-critical exposures while still being remediated promptly because the disclosed data includes credentials.
Session hijacking in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to spoof a legitimate user mid-onboarding and take over that user's session, ultimately gaining access to protected 802.1X networks. The root cause is an authentication bypass by spoofing (CWE-290): insufficient authentication checks during onboarding let the attacker trigger a redirection to the guest web portal and bind their device to the victim's in-flight session. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, score 3.8) confirms no credentials are required but that the attacker must be on the same Layer-2 segment and a genuine user must be actively onboarding; this is a deliberately disabled-by-default optional NAC feature rather than a baseline ISE capability, so real-world exploitability is narrow. No public exploit code and no active exploitation have been identified at time of analysis, and no EPSS signal was provided with the source data.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
Unauthenticated information disclosure in Concrete CMS releases before 9.5.3 allows a remote visitor who knows or can guess a valid Express entity identifier to query a legacy Express entry search endpoint that omits the canViewExpressEntries() permission check, returning entry attribute values that should be restricted to privileged users. The impact is read-only (C:L/I:N/A:N) and exploitation requires that identifier prerequisite, which is why the vendor and independent assessments both score it as hardening-limited rather than trivially exploitable; disclosure is worse for Express entities where supportsEntrySpecificPermissions() returns false, because EntryList::ignorePermissions() then bypasses per-entry filtering entirely. No public exploit code has been identified at time of analysis, and this CVE is not confirmed actively exploited (no CISA KEV listing); the fix is included in the 9.5.3 release.
Missing authorization in the ChangeWeDer CRM UserController index endpoint allows a remote attacker with a low-privilege authenticated account to reach functionality or data that should require stronger privileges, with limited confidentiality, integrity, and availability impact. The product has no versioning scheme and the project has not responded to the issue report, so no patched release is confirmed; exploitation requires network access to the Java CRM application and a valid low-privilege session. No public exploit identified at time of analysis.
Concrete CMS 9.2.0 through 9.5.3 fails to enforce an authorization check on its REST API user-creation endpoint (POST /ccm/api/1.0/users), so any request bearing a valid OAuth token that carries the users:add scope - including a client_credentials token with no associated user context - can create active, validated accounts while bypassing email verification and administrator approval. The endpoint's add() method in concrete/src/Api/Controller/Users.php performs no permission verification, making this a classic missing-authorization weakness (CWE-862) that an authenticated API consumer can abuse to gain a foothold. Under default registration settings the newly minted accounts are allowed to edit page content, which provides an escalation path to stored cross-site scripting and further compromise of the CMS. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the reporter-independent assessment rates the impact as limited to low integrity loss on the CMS itself.
Broken authorization in Concrete CMS 9 through 9.5.3 allows an authenticated user who already holds edit-board-contents permission on one board instance to query the custom-slot preview endpoint with an InstanceItem identifier belonging to a different board instance, causing the system to return summary fields - including the underlying page title and description - for pages that user is not permitted to view. The endpoint fails both to validate that the submitted item belongs to a board the requester is authorized to edit and to enforce page-view permission before generating the page-backed summary content. Rated CVSS v4.0 5.3 (our independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), this is a low-to-moderate severity IDOR-class information-disclosure flaw with no published exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); no user interaction is required, but exploitation is gated behind an authenticated account with per-board edit permission.
Improper authentication in ChangeWeDer CRM, up to commit c07bd4c97141521af6475034bc58523beed51bbd, allows unauthenticated remote attackers to manipulate the top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie cookie-handling path and affect login state (CWE-287). The assessed impact is limited to low confidentiality, integrity, and availability, and this is a low-priority issue despite the medium 6.9 CVSS because ChangeWeDer CRM is an obscure open-source Java application with rolling releases and a tiny real-world footprint. No public exploit code has been identified, no vendor patch is available, and the project has not responded to the reported issue at https://github.com/ChangeWeDer/crm/issues/2.
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
Apache NiFi 2.11.0 does not evaluate Process Group authorization when listing or submitting version-controlled Process Group migrations into a Connector, so an authenticated user holding only Connector-level permissions can reach flows they were never granted policy access to. Read access to a Connector is sufficient to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the user's read policies, while write access to a Connector allows migrating such a group - copying its flow definition, referenced assets, and component state into the Connector and leaving the source group disabled and renamed. Only installations that configure component-level authorization policies for Process Groups are affected, sensitive property values are excluded from migration, and the source group must already be stopped with empty queues; no public exploit code identified at time of analysis and the assessed impact is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Apache NiFi 1.5.0 through 2.11.0 expose REST API methods for replacing an entire Process Group's contents (flow replacement plus versioned-flow update and rebase) that enforce only read/write privileges on the target Process Group, while the parallel asynchronous update methods additionally authorize every component encapsulated in the flow plus referenced Controller Services, Parameter Contexts, and Parameter Providers. An authenticated user holding write access to one Process Group (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) can therefore submit a crafted flow definition that modifies or deletes components in descendant Process Groups governed by more restrictive policies, or binds components to referenced services and contexts they are not authorized to use. Exploitation is limited to deployments that actually rely on component-level authorization policies and to stopped components, since existing verification checks prevent modification of running ones; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in Apache NiFi 2.12.0.
Missing authorization in Apache NiFi 2.9.0 through 2.11.0 allows an authenticated user who already holds write privileges on a Connector to apply Secret and Asset references through the Connector configuration UPDATE and VERIFY REST API methods without the framework verifying that the user may read the backing Parameter Provider or that the Asset actually belongs to the Connector being configured. The result is limited confidentiality and integrity exposure: a user can surface Secret values backed by a Parameter Provider outside their read scope and can bind foreign Asset identifiers to a Connector, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N vector. Impact is confined to installations that deliberately implement different authorization levels across Connectors and Parameter Providers - the vendor states that deployments treating uniform Connector-write permission as the security boundary are not affected; there is no public exploit identified at time of analysis and no CISA KEV listing, which together with the tiered-configuration precondition makes this a low-priority authorization defect.
Improper authentication in Dell ObjectScale versions prior to 4.4.0.0 allows remote, unauthenticated attackers to bypass authentication and gain unauthorized access to the platform, with full impact to confidentiality, integrity, and availability (CVSS 3.1 8.1 High). The High attack complexity (AC:H) indicates exploitation requires satisfying a non-trivial precondition - such as a timing window or a specific system state in the authentication flow - rather than a single deterministic request, and no public exploit code has been identified at time of analysis. Only deployments running ObjectScale 4.4.0.0 and later are remediated, so older installations exposed on reachable management or S3 interfaces should be prioritized for upgrade.
BIND 9 secondary (slave) servers that restrict zone transfers with TSIG can be tricked into serving attacker-supplied zone contents: an attacker able to occupy or spoof the position of the configured primary can deliver a multi-message TCP IXFR whose final TSIG-signed message never arrives, and named commits and serves the records already received without rolling back to the pre-transfer state. Affected releases are BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25, along with the -S1 builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; no valid TSIG key is required (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, 6.5), but exploitation is conditional on the attacker's network position and the multi-message IXFR condition, so this is an integrity-only, high-complexity issue rather than a broadly reachable critical flaw. No public exploit identified at time of analysis and no CISA KEV listing; vendor patches are downloadable for the 9.20 and 9.21 branches.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
Credential disclosure in Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier allows users who already hold Item/Configure permission to capture credentials they are not entitled to by authoring or modifying a Pipeline that invokes the resolveScm step, which fails to establish the correct context for credentials lookup. The issue is an access-control scoping flaw (CWE-863) rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting the authenticated Item/Configure prerequisite, the high complexity of targeting specific credential IDs, and impact limited to confidentiality with no integrity or availability effect. It requires a Jenkins instance that actually uses Pipeline/multibranch jobs with resolveScm; at time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the vendor advisory of 2026-09-16 should be reviewed for the fixed release.
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST /admin-api/crm/customer/send-sms and /send-mail, because CrmCustomerController does not enforce authorization on those actions. Publicly available exploit code exists, but exploitation requires a valid back-office account (PR:L), is remote with no user interaction, and yields only limited integrity impact; no confidentiality or availability impact is assessed. The practical risk is therefore concentrated on malicious insiders or attackers who have already obtained CRM credentials, not pre-auth compromise of default installations.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function returns early and bypasses those initializations. Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init() is called, a failure triggers amdgpu_ttm_fini(), which calls amdgpu_vram_mgr_fini(), which then: - Calls list_for_each_entry_safe() on reservations_pending and reserved_pages, whose list_head::next pointers are zero-initialized (NULL). The loop does not recognize them as empty and dereferences NULL. - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally via for_each_free_tree(). Since mm->free_trees is NULL (never allocated), this dereferences NULL. Both result in a kernel panic on the module load error path. Fix by moving drmm_cgroup_register_region() to after the list and buddy allocator are fully initialized, so the teardown path is safe to run.
Missing authentication in the FastAPI backend of Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1 and 0.3.2) lets unauthenticated remote attackers reach API endpoints that should require credentials, because the dependency logic in backend/app/dependencies.py does not enforce an authentication check. The CVSS 4.0 base score is 6.9, and the vector (AV:N/AC:L/AT:N/PR:N/UI:N, LOW confidentiality/integrity/availability) indicates no credentials, no user interaction and no special conditions are needed; no public exploit code is identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Real-world priority remains low because the software is an obscure self-hosted hobby project, so exposure depends on someone operating a publicly reachable instance, and a successful bypass yields only LOW impact across all three security objectives.
Process Compose before 1.120.0 exposes its MCP SSE listener on loopback without validating the Host or Origin header or authenticating the caller, allowing a malicious website to reach that listener through DNS rebinding and issue MCP requests. Unauthenticated remote attackers (CVSS 4.0 PR:N, UI:P) can, when expose_control_tools is enabled, enumerate process state, read, search or truncate logs, and start, stop, restart or scale local processes; user-defined tools may expose further commands and output. Publicly available exploit code exists (SSVC Exploitation: poc), no active exploitation is confirmed (no CISA KEV listing), and the issue is fixed in 1.120.0.
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. It carries a low CVSS base score of 3.5, no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the available intelligence.
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. Severity is low - the vendor-published CVSS 4.0 base score is 2.3 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) and our independent assessment scores it CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - because exploitation demands LAN adjacency plus an unspecified device-state prerequisite and the immediate consequence is limited to enabling further access rather than full compromise.
Bransys ELD ships with hardcoded MQTT credentials that allow unauthenticated remote attackers to subscribe to the real-time telematics feed for every active device belonging to the subset of carriers that were connected to the affected MQTT broker. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the weakness is remotely reachable, low complexity, and requires no authentication or user interaction, but confines impact to low confidentiality - read-only exposure of real-time data with no integrity or availability effect, consistent with the vendor-side CVSS 4.0 score of 6.9 (VC:L, VI:N, VA:N). No public exploit code has been identified at time of analysis, though the hardcoded-credential nature of the flaw means anyone who extracts the static string from firmware or a decompiled mobile/app binary can reuse it without further tooling; practical exposure is bounded by whether the broker stays network-reachable and still accepts the unchanged credentials.
Improper authentication in the password-change handler of gedelumbung HospitalManagement allows an authenticated low-privilege user to tamper with another account's credentials by manipulating the kode_user/username argument passed to the simpan actions in application/modules/global/controllers/password.php and profil.php. The flaw is network-reachable, requires no victim interaction (CVSS:4.0 AV:N/AC:L/PR:L/UI:N) and yields partial confidentiality, integrity and availability impact (VC:L/VI:L/VA:L), consistent with the 5.3 base score; because the identifier is not bound to the caller's session, an attacker holding any valid account can target other users' password/profile records. Publicly available exploit code exists - the disclosure was filed as a public GitHub issue against the project - but there is no indication of confirmed active exploitation, and the maintainer has not responded or published a fix.
IBM Controller 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 permit an authenticated low-privilege user to bypass file-size validation by tampering with client-side input, producing low integrity and availability impact without confidentiality exposure. The issue is rated CVSS 5.4 and assessed as a moderate, not a priority, issue; no public exploit identified at time of analysis. A vendor patch is available per IBM advisory, and exploitation requires a valid IBM Controller account with network access.
This is a real but moderate-priority vulnerability whose severity depends almost entirely on deployment topology rather than the raw 6.5 CVSS score. Netty's HTTP decoder lets split or duplicated Transfer-Encoding header fields slip past its final-chunked validation, so an unauthenticated, remote attacker who can send a raw crafted request to a Netty listener that sits in an HTTP chain with a second HTTP parser (reverse proxy, load balancer, CDN, WAF, or upstream/downstream server) can desynchronize the two parsers and smuggle a request (CWE-444). Impact is confined to low confidentiality and integrity loss (C:L/I:L) with no availability impact, no authentication (PR:N) or user interaction (UI:N) is required, and no public exploit identified at time of analysis.
Parameter substitution in the Elytron token-realm of Red Hat JBoss EAP 7, JBoss EAP 8 and the EAP Expansion Pack allows a remote attacker to manipulate OAuth2 token-introspection requests because parameters are assembled without URL encoding. Only deployments whose application security domain is backed by a token-realm configured with oauth2-introspection are exposed; other realm types (properties, JDBC, LDAP, or JWT validation without introspection) are unaffected, and the achievable impact is limited to Low confidentiality and Low integrity with no availability impact. Vendor scoring is 4.2 on an AC:H basis because success hinges on how the downstream introspection endpoint parses the injected parameters, and no public exploit has been identified at time of analysis.
Sandbox escape in vm2 through 3.12.0 lets untrusted guest code cross the NodeVM isolation boundary and change process-wide state by calling crypto.setFips(), which toggles the FIPS mode of the entire host Node.js process (observed as crypto.getFips() flipping from 0 to 1 in the reporter's test). The vulnerability is only reachable when the embedding application runs vm2 as a NodeVM with the non-default, opt-in configuration require.builtin: ['crypto']; authentication and user interaction are not required in that scenario, and the practical impact is limited to low-integrity and low-availability effects rather than arbitrary host code execution or data disclosure. No public exploit identified at time of analysis; the issue is fixed in vm2 3.12.1, available from the vendor (GHSA-x3v6-43hc-82mc).
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct sustained brute-force attacks against the login interface, potentially leading to unauthorized system access. The vulnerability (CWE-307) is remotely exploitable without authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), but success is limited to weak, reused, or guessable credentials and is effectively mitigated by MFA, rate-limiting, IP throttling, or strong password policies. No public exploit identified at time of analysis, and active exploitation has not been confirmed (not in CISA KEV).
Certificate revocation validation performed by Netty's optional netty-handler-ssl-ocsp module can be silently skipped when the OCSP response omits the optional nextUpdate field, causing the application to proceed with a certificate that should have been rejected. The flaw is remote and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), but exploitation is conditional: the deployment must actually use the opt-in OCSP-stapling component, and the attacker must control or intercept the OCSP response seen by the client, typically through a man-in-the-middle position or by operating the TLS server whose certificate is being validated. There is no public exploit identified at time of analysis and no KEV listing, and the practical impact is confined to acceptance of a revoked or otherwise unvalidated certificate rather than code execution or data disclosure.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Missing authorization checks in the Foxtool All-in-One plugin for WordPress (all versions up to and including 2.5.3) allow any authenticated subscriber-level user to modify arbitrary subkeys of the plugin's foxtool_settings option, including the media-up3 toggle that enables site-wide SVG uploads - a change that can be chained into stored cross-site scripting through a malicious SVG file rendered by a victim. The settings modification itself is unauthenticated only in the sense that no additional user interaction is required once a low-privileged account exists; exploitation therefore matters mainly on sites with open registration or untrusted subscriber accounts. Real-world risk is moderate-to-low: the direct impact is a limited integrity violation (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the XSS escalation is conditional on a second step, and no public exploit code or active exploitation was identified at time of analysis.
Bypass of the registration CAPTCHA in the WordPress Clean Login plugin before 1.19 allows unauthenticated attackers to create accounts without solving the challenge when the stored session value is empty. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) was reported, and our independent assessment rates this as a genuine low-to-moderate priority issue because the impact is limited to spam and automation abuse rather than compromise of existing accounts or the server. The vendor has released version 1.19 as the fixed release.
The Clean Login WordPress plugin before 1.19 lets unauthenticated attackers create user accounts on sites where registration is disabled, bypassing an administrative control intended to prevent open sign-ups. The registration handler fails to check the site's registration-enabled setting, so even locked-down sites become vulnerable; impact is limited to unauthorized low-privilege account creation (CVSS I:L) with no direct confidentiality or availability loss. Publicly available exploit code exists, and the vendor has released a patched version (1.19).
Unauthenticated attackers can create WordPress user accounts on sites running the Easy Form Builder by WhiteStudio plugin in versions 4.0.0 through before 4.2.0, even when the site owner has deliberately disabled user registration. The plugin fails to validate a submitted value against its stored configuration for certain form types (CWE-284, improper access control), so the registration-disabled setting is bypassed via a remote, unauthenticated request requiring no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3). Publicly available exploit code exists for this issue, but it is not confirmed as actively exploited (not in CISA KEV); the realistic impact is bounded by the site's default new-user role, typically Subscriber, and updating to 4.2.0 fully removes the flaw.
Cross-user lock manipulation in the Nextcloud Files Lock (files_lock) app allows any authenticated user to lock or unlock files they do not own by supplying the absolute WebDAV path of another user's file, because the DAV plugin resolves the request URI without confirming that the path belongs to the session user. An attacker who can enumerate or guess a victim's path can block editor saves and PUT/MOVE/DELETE writes, and can also have the application hand back the victim's lock token, which enables removal of token-based client locks. Rated 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in the authoritative assessment, it requires a valid account and an enabled files_lock app on a multi-user instance; impact is limited to denial-of-write and lock-token disclosure with no file content read/write or code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis.
CubeCart versions prior to 6.7.5 contain a broken access-control flaw in the admin order-note deletion handler (admin/sources/orders.index.inc.php), allowing an authenticated administrator who lacks the CC_PERM_DELETE order-modification privilege to delete records from the CubeCart_order_notes table with a single crafted request. The handler only checks that order_id and delete-note parameters are present, so back-office staff with restricted roles can erase order-history and audit-trail notes. No public exploit identified at time of analysis; the CVSS 5.4 score reflects limited integrity and availability impact confined to note deletion, not broader data disclosure or code execution.
Unauthenticated attackers can read unpublished car listings belonging to any user on WordPress sites running the Motors - Car Dealership & Classified Listings plugin through version 1.4.120, because the mvl_ajax_dealer_load_cars() AJAX handler performs no authorization or ownership check on the requested listings. The exposure is limited to confidentiality (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - draft, pending, private, and scheduled 'future' listings can be enumerated and retrieved, but no data can be modified and no denial of service results. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; independent assessment rates this a genuine but modest-severity issue rather than a high-priority emergency, so the practical concern is information disclosure of pre-publication dealer inventory and any sensitive details held in those listings.
Unauthenticated attackers can create fully approved appointment and event bookings without completing payment in the WordPress plugin 'Booking for Appointments and Events Calendar - Amelia' in all versions up to and including 2.4.5. The plugin trusts a client-supplied package-redemption identifier as proof of payment and never validates it server-side, so forging that value is enough to mark a booking as paid and confirmed, a business-logic/authorization weakness (CWE-862) scored CVSS 5.3 (integrity-low, no confidentiality or availability impact). Exploitation is limited to fraudulent booking creation and calendar-slot consumption, and sites that do not sell paid packages or appointments have minimal practical exposure; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV).
Broken access control in the WordPress booking plugin 'Booking for Appointments and Events Calendar - Amelia' (Premium edition, versions up to and including 2.4.4) allows an authenticated attacker holding the wpamelia-provider role to read and modify any customer record through the /users/customers/<id> endpoint, including triggering a customer password reset, because the handler never verifies that the requesting provider owns the targeted customer. The same missing ownership check can be chained to take over a linked WordPress account with a role as high as Editor, but only where that WordPress user has previously made an Amelia booking; free-version installs are unaffected because the Employee Panel does not exist there. Per the CVSS vector (PR:L) exploitation requires an authenticated account with the provider role, scoring 5.4 overall, and no public exploit identified at time of analysis - no CISA KEV listing and no published PoC or EPSS signal was present in the supplied intelligence.
Caddy Proxy Manager releases prior to 1.5.1 ship with email/password self-registration enabled by default at /api/auth/sign-up/email, so unauthenticated remote attackers can create an active account without any administrator approval step (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). The resulting account is assigned only the low-privilege 'user' role, which cannot view or modify proxy configurations or certificates, so the practical impact is limited to unauthorized account creation and a potential foothold rather than administrative compromise. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; version 1.5.1 fixes the insecure default by requiring the operator to set AUTH_ALLOW_SELF_REGISTRATION=true before sign-up is permitted.
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. The flaw affects C Driver 2.0.0 through versions before 2.3.2, and the vendor explicitly notes TLS mitigates it, so standard TLS-protected production deployments are not exploitable; no public exploit code was identified at time of analysis. The vendor/ENISA CVSS 4.0 base score is 6.3, while our independent assessment (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) rates real-world risk moderate-to-low because exploitation requires both a man-in-the-middle position and an unencrypted or TLS-stripped MongoDB connection, and the payoff is only a captured proof that must still be cracked.
Missing authorization in the mayfly-go AI Assistant (server/internal/ai/api/ai.go) allows an authenticated user - authenticated, per CVSS PR:L - to execute compound shell commands without a genuine approval gate; the command whitelist is only one token wide, so any chained command containing curl, wget, or sed auto-runs, and approval can be self-granted by the same session user. All versions up to and including 1.11.5 are affected, and publicly available exploit code exists (a gist PoC is referenced); the issue is not listed in CISA KEV, so there is no confirmation of active exploitation. This is a low-priority issue by every available signal: the vendor-assigned CVSS 4.0 base score is 2.1, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and CISA's SSVC decision framework rates exploitation as 'poc', automatable as 'no', and technical impact as 'partial'. The practical effect is a bounded policy bypass enabling unapproved command execution within a legitimate user's existing privileges, not a privilege-escalation or full-compromise primitive.
Missing space-membership authorization checks in Scoold prior to 1.69.0 let any authenticated user write replies and comments into question threads belonging to private spaces they are not members of, resulting in unauthorized modification of private discussions. The flaw only manifests in the non-default configuration where scoold.is_default_space_public is set to false and private spaces are actually in use, and it requires a valid session plus knowledge (or enumeration) of a target question identifier; the attacker gains write access only, not read access, to the affected thread. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5), exploitation is authenticated and integrity-only, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the vendor-released fix is version 1.69.0.
Scoold deployments prior to 1.69.0 expose replies to questions in private spaces through the answers API: a holder of a valid personal API token can call GET /api/posts/{id}/answers and receive the reply bodies of a private-space question whose own endpoint correctly denies access. The flaw affects instances configured with both scoold.api_enabled and scoold.api_user_access_enabled set to true, and exploitation additionally requires the attacker to know or enumerate the target question's identifier, so it is a confidentiality-only (C:H, no I/A) disclosure of existing private discussion content rated 6.5. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the vendor has released a fix in 1.69.0.
Broken per-user authorization in WireGuard Portal (wg-portal) versions 2.2.0 through 2.2.x allows an authenticated low-privilege user to enumerate other users' peer public keys and monitor their BytesReceived/BytesTransmitted counters by connecting to the statistics WebSocket at /api/v0/ws. The same endpoint also exposes administrator-only interface names and interface statistics, though tunnel content, AllowedIPs, and user identities remain authorization-gated; the issue is fixed in version 2.3.0. No public exploit code identified at time of analysis, and the impact is limited to information disclosure on multi-user instances.
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace existing files on disk that are owned by another package or unmanaged by mport, compromising local filesystem integrity and package database consistency. The flaw requires user interaction (UI:P) and specific attack requirements (AT:P), and is unauthenticated according to the CVSS vector (PR:N). No public exploit was identified at time of analysis; the vendor fixed the issue in version 2.7.8.
Mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.8 through 3.0.11 allows a man-in-the-middle who cannot prove knowledge of the shared secret to be accepted as a legitimate server when SCRAM-SHA-256 or Digest mutual authentication is used over a non-TLS or already-compromised transport. The affected interceptor methods computed the SCRAM ServerSignature or Digest rspauth verification value but only logged a mismatch and still delivered the response to the application as authenticated, so the client silently loses its only signal that the peer is an impostor. Over TLS the flaw is inert because a genuine server always returns a valid verification value; exploitation requires a MITM position (AC:H), the impact is limited to authentication-assurance loss (C:N/I:L/A:N), and no public exploit code or active exploitation has been identified at time of analysis. Fixed in version 3.0.12.
In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smack_msg_queue_msgrcv The smack_msg_queue_msgrcv() function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd() syscall path, if a receiver is already waiting, the pipelined_send() optimization is used to push the message directly to the receiver task: ipc/msg.c`pipelined_send(): ` smp_store_release(&msr->r_msg, msg) In this case, the 'sender' (current) task performs the check on behalf of the 'receiver' task (msr->r_tsk, passed as the 'target' parameter): ipc/msg.c`pipelined_send(): ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,) However, smack_msg_queue_msgrcv() ignores the 'target' and checks 'current': smack_msg_queue_msgrcv(…) ` smk_curacc_msq(isp, MAY_READWRITE); // current task 'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement, but 'target' (the receiver task) might NOT; as a result, an unauthorized receiver gets the message, violating MAC policy. Test: 1) create a sysv message queue with label “foo” 2) echo "bar foo r" >/smack/load2 3) msgrcv(,,,0,MSG_NOERROR) in "bar"-labeled task. The task is waiting for the messages ... 4) msgsnd() from a "foo"-labeled task: "bar"-labeled task gets the message. This patch fixes the issue by checking permission on the 'target' task instead of 'current'. (2008-02-04, Casey Schaufler)
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If either calls to ->iomap_end() or ->iomap_begin() fail, the direct return paths bypass the batch cleanup. The ->iomap_end() case is not a practical issue at the moment because there is no user of the mechanism that returns an error from this path. The ->iomap_begin() case is theoretically possible because XFS can invoke the fill helper and error out at various points thereafter. This subtly complicates things because XFS does not transfer iomap_flags to the iomap data structure in the error path. To deal with both of these issues, first make sure to invoke the cleanup helper in the error path for either fs callback. Second, update the helper to clear the flag unconditionally and release the batch so long as it is populated. This more clearly delineates the purpose of the flag to control the I/O path and not necessarily the status of the fbatch, so add a comment around this as well.
In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size. If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged. Use hugepage_put_subpool() on the failure path, matching the normal put_super path.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_put_stid() releases the svc_export tracked in nfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and lock stateids by calling ->sc_free() directly, bypassing that path. An open stateid takes an sc_export reference in nfs4_open() and a lock stateid takes its own in init_lock_stateid(); both reach free_ol_stateid_reaplist() through their normal teardown, the open stateid via release_open_stateid() and the lock stateid via nfsd4_release_lockowner(), each through put_ol_stateid_locked(). The reference is therefore never dropped, pinning the export and blocking unmount for the lifetime of the stateid. Release sc_export in free_ol_stateid_reaplist() the way nfs4_put_stid() does. ->sc_free() runs once per stateid, and a stateid reaches free_ol_stateid_reaplist() or nfs4_put_stid() but never both, so the reference is dropped exactly once. Revoked stateids reach this path with sc_export already cleared by drop_stid_export(), so they are skipped rather than double-freed. nfs4_put_stid() itself read sc_export before acquiring cl_lock. drop_stid_export() clears that field and releases the reference under cl_lock, so a concurrent revocation could drop the export in the window between the read and the final put, releasing the same reference twice. Read sc_export while cl_lock is held so the two paths serialize and the reference is released exactly once.
Authentication bypass in Steeltoe.Security.Authorization.Certificate (Steeltoe prior to 4.3.0) lets remote unauthenticated attackers spoof the X-Client-Cert header to defeat the SameOrg and SameSpace authorization policies, gaining access to resources belonging to another organization or space. The flaw is that AddOrgAndSpacePolicies() combined with UseCertificateAuthorization() trusts a client-supplied public certificate without verifying proof of possession of the matching private key, and common Cloud Foundry routers pass the header through to the application. Exploitation is unauthenticated (PR:N) but high complexity (AC:H) and only succeeds when ingress does not restrict inbound traffic to a known trusted proxy source IP and the attacker already holds the public certificate of an application instance in the target org or space; there is no public exploit code and no CISA KEV entry, and EPSS data was not provided, so the practical risk is moderate and deployment-dependent. Fixed in Steeltoe 4.3.0.
BMCtest's test harness starts an Ironic bare-metal provisioning service without authentication or TLS, letting an attacker on the adjacent network modify node and provisioning state through the unauthenticated Ironic API for as long as the test is running. Exploitation is heavily constrained by a timing race: the unprotected Ironic instance exists only during an active bmctest run, and the attacker must reach the API before the harness tears it down, which is why the CVSS vector carries AC:H and the overall score is only 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity-only impact). No public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the CWE-306 missing-authentication framing.
Sandbox escape and read-only bypass in vm2 3.9.6 through 3.11.6 lets untrusted JavaScript running inside a NodeVM defeat the vm.freeze() and vm.readonly() protections and mutate host object properties that the embedder explicitly marked immutable. An attacker uses Object.getOwnPropertyDescriptor() or __lookupSetter__() to recover host-realm setters from accessor properties on frozen objects and invoke them directly, circumventing the Proxy-based restrictions. The CVSS 4.0 vector (PR:N, AC:H, AT:P, VI:L/SI:L, no C/I/A beyond low integrity) confirms unauthenticated access but high attack complexity and an integrity-only ceiling with no code execution; two prerequisites must hold (untrusted code executed in vm2, and reliance on vm.freeze()/vm.readonly() to protect reachable host objects). No public exploit identified at time of analysis, there is no CISA KEV listing, and vm2 is deprecated, which further narrows realistic exposure to legacy deployments using versions 3.9.6 to 3.11.6.
Unauthenticated broken access control in the BerqWP WordPress plugin (versions up to and including 4.1.15) lets remote attackers reach functionality that should require authorization, resulting in limited unauthorized modification of site state with no data disclosure or denial of service (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Any WordPress site running an affected version of this niche caching/performance plugin is exposed, though the impact ceiling is low-integrity changes rather than code execution or data theft. There is no public exploit identified at time of analysis, and no CISA KEV entry; the practical risk is bounded by the plugin's small install footprint and the sub-score-only integrity impact.
Unauthenticated information disclosure affects the WordPress plugin User Registration (WPEverest) at versions 5.2.7 and earlier, where a missing authorization check lets remote visitors reach data that should require higher privileges. The assessed CVSS vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the issue is remotely reachable with no credentials and no user interaction, but impact is bounded to confidentiality - there is no evidence of data modification or full account takeover. At time of analysis there is no CISA KEV listing and no public exploit identified; the 'Authentication Bypass' tag should be read in the narrow sense of unauthorized data access rather than a complete authentication defeat.
Unauthenticated broken access control in the WordPress plugin Booking Calendar (wpdevelop) at version 11.7 and earlier lets remote attackers invoke booking-related functionality that should require authorization, with no credentials and no user interaction required. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), impact is limited to low integrity - unauthorized actions or manipulation within the plugin's booking data - with no confidentiality or availability effect, so this is a genuine but modest-priority issue. Exploitation is constrained only by the target running an unpatched copy of this specific plugin; no public exploit code has been identified and the issue is not confirmed actively exploited (not in CISA KEV) at time of analysis. Reported by Patchstack and tracked as EUVD-2026-81515.
Broken access control in the Simple Membership WordPress plugin (versions up to 4.8.2) allows an authenticated Contributor-level user to perform unauthorized integrity-affecting actions, such as modifying membership settings or data, without requiring user interaction. The vulnerability is remotely reachable with low complexity (CVSS 5.3), but its impact is limited to low integrity loss with no confidentiality or availability impact, making it a modest risk despite the network vector. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the advisory's CVSS vector lists PR:N while the title specifies a Contributor prerequisite, a discrepancy to confirm via Patchstack.
Authorization bypass in the Cooked WordPress plugin through version 1.16.0 allows an authenticated user holding only Contributor-level privileges to manipulate objects belonging to other users by supplying an unauthorized object identifier. The flaw is remote and requires no victim interaction, but it is gated behind a mandatory low-privilege account, which the independent assessment classifies as a genuine yet moderate-priority authorization defect rather than a critical one. Impact is limited to low integrity and low availability effects with no confidentiality exposure per the assessed vector (CVSS 5.4), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can access sensitive information from WordPress sites running the Easy Invoice plugin versions up to and including 2.3.8 due to a missing authorization check (CWE-862). The vulnerability requires only network access to the target site and results in partial confidentiality impact (CVSS 5.3), with no data modification or denial of service. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated insecure direct object reference (IDOR) in the King Addons for Elementor WordPress plugin at versions up to and including 51.1.81 lets remote attackers manipulate objects belonging to other users or site roles by supplying a crafted object identifier to an affected endpoint, with no authentication or user interaction required (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). Impact is deliberately narrow: only Low integrity is affected (I:L), with no confidentiality or availability loss and no scope change, so the practical worst case is unauthorized modification of a single object rather than data theft or site takeover. No public exploit has been identified at time of analysis, and the issue is reported through Patchstack; no vendor-released fixed version is published as of this assessment, so mitigation currently depends on virtual patching or deactivating the plugin.
Local denial of service in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an unauthenticated attacker with local access to crash or degrade the OMSA agent by exploiting a missing authentication check on a critical function. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms the attack requires local access and no privileges, but impact is limited to partial availability loss with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE; the risk is confined to environments where untrusted or low-privilege users can run code locally on managed Dell servers.
Local attackers holding a low-privileged workload on an Eclipse Ankaios agent can bypass log-access authorization to read other workloads' logs on the same agent. The flaw affects Eclipse Ankaios 0.6.0 through 1.0.3, where the agent's control-interface authorizer stops evaluating a rule at the first wildcard pattern and therefore skips later deny LogRule entries; exploitation requires a rule set in which a wildcard-containing entry precedes a deny rule. This is a low-severity authorization flaw (CVSS 4.8, CWE-863) requiring local access and an existing workload foothold, with no public exploit identified at time of analysis.
Logout revocation bypass in SUSE NeuVector lets an authenticated holder of a valid, unexpired NeuVector JWT keep using that token after logout by re-encoding the RSA signature field with a noncanonical-but-equivalent Base64URL spelling, which no longer matches the exact-string logout/revocation blocklist while still passing signature verification. The issue is remotely reachable (AV:N) but requires a previously issued token (PR:L) and non-trivial crafting of an equivalent encoding (AC:H), and the exposure window is strictly bounded by the original token's remaining validity and its original scope, with only partial confidentiality and integrity impact and no availability impact. This is CWE-863 incorrect authorization; no public exploit code identified at time of analysis.
Local authentication bypass in the Acer System Monitoring component bundled with NitroSense (Nitro laptops) and PredatorSense (Predator laptops) lets any user who already holds a session or code execution on the machine open a WebSocket connection to the monitoring service without supplying credentials, because the handshake never performs an authentication check (CWE-306). Exploitation is constrained to the local attack vector (AV:L) and requires the component to be installed and running; it is not remotely reachable, the vendor's own description hedges with 'under certain circumstances', and the exploit is unproven (E:U). Impact is confined to Low confidentiality, integrity, and availability effects on service functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis, making this a low-priority issue by every available signal.
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated WordPress user with Contributor-level access or above on sites running the Event Booking Manager for WooCommerce plugin in versions 5.3.6 up to but not including 5.6.0. The plugin fails to enforce a capability check on the code that renders its stored gateway configuration, so a low-privilege author account can retrieve secrets intended only for administrators; publicly available exploit code exists, and the vendor has released a fix in 5.6.0. The practical risk is moderate rather than critical because a valid Contributor account is required and the plugin must have PayPal and/or Stripe credentials configured, but any site that allows Contributor self-registration or has many low-trust authors should treat the exposure as urgent and rotate keys immediately.
Unauthenticated remote attackers can read any author's non-published car listings - including titles, prices, media URLs and seller notes - from WordPress sites running the Motors plugin before version 1.4.121, simply by supplying the target's numeric WordPress user ID, because the endpoint that serves draft, pending and private listings performs no authorization check (CWE-639). The issue carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a read-only confidentiality impact with no authentication, user interaction, or non-default configuration required; publicly available exploit code exists per WPScan, and no CISA KEV entry confirms active exploitation. Impact is bounded to information disclosure of unpublished listing data - no integrity or availability effect - but the exposed fields (pricing strategy, unpublished media, seller notes) can be commercially sensitive and facilitate competitive or social-engineering reconnaissance.
Unauthenticated remote attackers can disable any Popup Builder popup on WordPress sites running Master Addons for Elementor versions 3.0.0 through before 3.1.9, because the plugin's AJAX popup-deactivation action performs no authorization check and relies solely on a nonce that is exposed to every visitor. Publicly available exploit code exists, but the impact is deliberately narrow: only the integrity of the popup feature (CWE-862 missing authorization, CVSS 5.3 with I:L) is affected, there is no data disclosure or code execution, and an administrator can undo the change by re-enabling the popup. The vendor has released a patch in version 3.1.9, and the issue is not listed in CISA KEV.
Any authenticated WordPress user - including a subscriber with no elevated privileges - can permanently delete every stored form submission in versions of the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' plugin prior to 5.1.1, because the plugin's message-deletion AJAX action performs no capability check and merely tests that a nonce parameter is present rather than validating it. The attack is network-reachable, needs no user interaction and no valid nonce, and publicly available exploit code exists, so the practical barrier is simply holding any low-privilege account (for example, via open registration). This is a genuine but moderate-priority integrity issue rather than an inflated critical finding: the assessed vector rates integrity impact as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, consistent with a full wipe of stored submission data), but there is no confidentiality or availability impact and no confirmed active exploitation at time of analysis.
Missing signature enforcement in the Autopay WordPress payment-gateway plugin before 5.0.1 lets unauthenticated remote attackers disclose and delete the stored payment parameters of other customers' orders through the plugin's payment callback endpoint (CVSS 6.5, CWE-863). The assessed vector AV:N/AC:L/PR:N/UI:N confirms exploitation needs no authentication or user interaction - only network reachability to the callback plus knowledge or enumeration of target order identifiers - and publicly available exploit code exists, although there is no confirmed active exploitation. Impact is scoped to disclosure and deletion of stored payment parameters rather than full site compromise, and real-world exposure is limited by the plugin's niche, largely Polish-market footprint.
Local unauthenticated access to the Acer Agent Service - the background component shipped with Acer's NitroSense and PredatorSense utilities on Nitro and Predator Windows laptops - allows any user or piece of malware already running on the host to open a connection to the service socket and reach functionality that should be restricted, because the socket handshake never verifies the caller's identity (CWE-306). Rated CVSS 4.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H) and scored by our assessment as CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, the flaw is not remotely reachable and requires the Acer software to be installed, with the vendor description noting the unauthenticated handshake path succeeds only 'under certain circumstances.' No public exploit has been identified at time of analysis, and the practical exposure is a local privilege/functionality boundary bypass rather than an internet-facing emergency.
Local attackers with access to an Acer Nitro or Predator laptop can recover a hard-coded AES key used by the Acer Agent Service, a component bundled with NitroSense and PredatorSense, allowing access to protected information or unauthorized actions. The vulnerability is rated CVSS 4.9 and is not known to be actively exploited; no public exploit was identified at time of analysis, and the vendor marks exploit maturity as Unproven. Because the key is identical across installations, any local copy of the affected software can expose it.
Non-atomic rate-limit counter increments in AVideo through 29.0 let remote unauthenticated attackers bypass the platform's documented 30-attempts-per-5-minute login throttle simply by firing genuinely concurrent credential guesses, multiplying their effective attempt rate by their connection concurrency. The weakness only degrades a protective control, so abuse still requires a brute-forceable account (weak or guessable password, no MFA, and no independent account lockout), which keeps this a moderate, defense-in-depth issue rather than a critical priority. No public exploit code has been identified at time of analysis, and the assigned CVSS 4.0 base score is 6.9 for low confidentiality and integrity impact to the vulnerable system.
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified because the otlploggrpc exporter reads TLS certificate settings from environment variables into its config but never applies them to the gRPC transport credentials. When TLS is configured only through OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and the related client-certificate/key variables - and the application does not additionally call WithTLSCredentials in code - the client falls back to credentials.NewTLS with system roots and no client certificate, so the intended private-CA pinning and mutual TLS are bypassed. A network attacker in a man-in-the-middle position who can present a certificate chaining to the victim host's system trust store can read or alter exported log data; misconfigured code paths that do pass WithTLSCredentials are unaffected, the system-trusted-certificate prerequisite is a significant limiting factor, and no public exploit was identified at time of analysis. The issue is fixed in otlploggrpc v0.21.0.
Unauthenticated users can download translated files from LibreTranslate deployments running version 1.9.6 or earlier because the download_file route is missing the access_check decorator, letting requests bypass the API key requirement and ban-list enforcement that operators configured for protected instances (CWE-862 missing authorization). Impact is limited to reading translated file output with no integrity or availability effect, and practical exposure depends on whether download identifiers are predictable or enumerable by the attacker. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS v4.0 base score of 6.9 reflects unauthenticated network reachability combined with low confidentiality impact.
Guest-level users on kan through 0.6.0 can create boards they are not entitled to create by invoking the GitHub project import mutation, which never applies the board:create permission check that the normal board-creation path enforces. The impact is an authenticated, integrity-only authorization bypass (assessed CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/C:N/I:L/A:N) that requires the attacker to already hold a low-privilege account on the target instance; there is no disclosure of other users' data and no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so this is a genuine but low-severity permission-model defect rather than an emergency.
Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.
Organization-scoped API tokens in OpenCVE before 3.1.0 can list and retrieve every organization belonging to the token creator because the organizations API endpoint ignores the token's organization scope. This is a low-severity confidentiality-only broken-access-control flaw (CWE-863); exploitation requires a valid organization-scoped token (authenticated, PR:L) whose creator belongs to multiple organizations, and it yields no extra data in single-organization deployments. No public exploit identified at time of analysis; vendor-released patch: 3.1.0.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Missing server-side validation of administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) lets an authenticated, remote administrative user modify configuration content that should be gated behind a higher privilege level, specifically the descriptions of files on one particular page. Only ISE deployments exposing the management interface to a reachable network are affected, and exploitation requires a valid administrative credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so confidentiality and availability are untouched and only a narrow integrity element is at risk. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS signal was not provided; despite the 'Authentication Bypass' tag attached to this record by some feeds, the flaw is an authorization-enforcement gap rather than a way to authenticate without credentials.
Missing per-role authorization checks in the CommPilot web-based management interface of Cisco BroadWorks allow an authenticated, low-privilege remote user to alter configurations on select administrative pages via a crafted HTTP request. The issue (CVE-2026-76438, CWE-863, CVSS 6.5 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affects BroadWorks releases 21.0 through 26.0, including the 21.sp1 line and assorted RI builds, with the assessed impact limited to configuration integrity - no confidentiality or availability loss per the vector. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a routine, patch-priority access-control defect rather than an emergency: a valid low-privilege CommPilot account is a prerequisite, and BroadWorks management interfaces are normally confined to carrier or management networks.
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. Impact is limited to confidentiality (C:H, no integrity or availability effect, CVSS 4.9 / PR:H), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but tightly-gated confidentiality issue rather than a broad emergency, and should be prioritized behind perimeter-critical exposures while still being remediated promptly because the disclosed data includes credentials.
Session hijacking in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to spoof a legitimate user mid-onboarding and take over that user's session, ultimately gaining access to protected 802.1X networks. The root cause is an authentication bypass by spoofing (CWE-290): insufficient authentication checks during onboarding let the attacker trigger a redirection to the guest web portal and bind their device to the victim's in-flight session. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, score 3.8) confirms no credentials are required but that the attacker must be on the same Layer-2 segment and a genuine user must be actively onboarding; this is a deliberately disabled-by-default optional NAC feature rather than a baseline ISE capability, so real-world exploitability is narrow. No public exploit code and no active exploitation have been identified at time of analysis, and no EPSS signal was provided with the source data.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
Unauthenticated information disclosure in Concrete CMS releases before 9.5.3 allows a remote visitor who knows or can guess a valid Express entity identifier to query a legacy Express entry search endpoint that omits the canViewExpressEntries() permission check, returning entry attribute values that should be restricted to privileged users. The impact is read-only (C:L/I:N/A:N) and exploitation requires that identifier prerequisite, which is why the vendor and independent assessments both score it as hardening-limited rather than trivially exploitable; disclosure is worse for Express entities where supportsEntrySpecificPermissions() returns false, because EntryList::ignorePermissions() then bypasses per-entry filtering entirely. No public exploit code has been identified at time of analysis, and this CVE is not confirmed actively exploited (no CISA KEV listing); the fix is included in the 9.5.3 release.
Missing authorization in the ChangeWeDer CRM UserController index endpoint allows a remote attacker with a low-privilege authenticated account to reach functionality or data that should require stronger privileges, with limited confidentiality, integrity, and availability impact. The product has no versioning scheme and the project has not responded to the issue report, so no patched release is confirmed; exploitation requires network access to the Java CRM application and a valid low-privilege session. No public exploit identified at time of analysis.
Concrete CMS 9.2.0 through 9.5.3 fails to enforce an authorization check on its REST API user-creation endpoint (POST /ccm/api/1.0/users), so any request bearing a valid OAuth token that carries the users:add scope - including a client_credentials token with no associated user context - can create active, validated accounts while bypassing email verification and administrator approval. The endpoint's add() method in concrete/src/Api/Controller/Users.php performs no permission verification, making this a classic missing-authorization weakness (CWE-862) that an authenticated API consumer can abuse to gain a foothold. Under default registration settings the newly minted accounts are allowed to edit page content, which provides an escalation path to stored cross-site scripting and further compromise of the CMS. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the reporter-independent assessment rates the impact as limited to low integrity loss on the CMS itself.
Broken authorization in Concrete CMS 9 through 9.5.3 allows an authenticated user who already holds edit-board-contents permission on one board instance to query the custom-slot preview endpoint with an InstanceItem identifier belonging to a different board instance, causing the system to return summary fields - including the underlying page title and description - for pages that user is not permitted to view. The endpoint fails both to validate that the submitted item belongs to a board the requester is authorized to edit and to enforce page-view permission before generating the page-backed summary content. Rated CVSS v4.0 5.3 (our independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), this is a low-to-moderate severity IDOR-class information-disclosure flaw with no published exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); no user interaction is required, but exploitation is gated behind an authenticated account with per-board edit permission.
Improper authentication in ChangeWeDer CRM, up to commit c07bd4c97141521af6475034bc58523beed51bbd, allows unauthenticated remote attackers to manipulate the top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie cookie-handling path and affect login state (CWE-287). The assessed impact is limited to low confidentiality, integrity, and availability, and this is a low-priority issue despite the medium 6.9 CVSS because ChangeWeDer CRM is an obscure open-source Java application with rolling releases and a tiny real-world footprint. No public exploit code has been identified, no vendor patch is available, and the project has not responded to the reported issue at https://github.com/ChangeWeDer/crm/issues/2.
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
Apache NiFi 2.11.0 does not evaluate Process Group authorization when listing or submitting version-controlled Process Group migrations into a Connector, so an authenticated user holding only Connector-level permissions can reach flows they were never granted policy access to. Read access to a Connector is sufficient to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the user's read policies, while write access to a Connector allows migrating such a group - copying its flow definition, referenced assets, and component state into the Connector and leaving the source group disabled and renamed. Only installations that configure component-level authorization policies for Process Groups are affected, sensitive property values are excluded from migration, and the source group must already be stopped with empty queues; no public exploit code identified at time of analysis and the assessed impact is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Apache NiFi 1.5.0 through 2.11.0 expose REST API methods for replacing an entire Process Group's contents (flow replacement plus versioned-flow update and rebase) that enforce only read/write privileges on the target Process Group, while the parallel asynchronous update methods additionally authorize every component encapsulated in the flow plus referenced Controller Services, Parameter Contexts, and Parameter Providers. An authenticated user holding write access to one Process Group (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) can therefore submit a crafted flow definition that modifies or deletes components in descendant Process Groups governed by more restrictive policies, or binds components to referenced services and contexts they are not authorized to use. Exploitation is limited to deployments that actually rely on component-level authorization policies and to stopped components, since existing verification checks prevent modification of running ones; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in Apache NiFi 2.12.0.
Missing authorization in Apache NiFi 2.9.0 through 2.11.0 allows an authenticated user who already holds write privileges on a Connector to apply Secret and Asset references through the Connector configuration UPDATE and VERIFY REST API methods without the framework verifying that the user may read the backing Parameter Provider or that the Asset actually belongs to the Connector being configured. The result is limited confidentiality and integrity exposure: a user can surface Secret values backed by a Parameter Provider outside their read scope and can bind foreign Asset identifiers to a Connector, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N vector. Impact is confined to installations that deliberately implement different authorization levels across Connectors and Parameter Providers - the vendor states that deployments treating uniform Connector-write permission as the security boundary are not affected; there is no public exploit identified at time of analysis and no CISA KEV listing, which together with the tiered-configuration precondition makes this a low-priority authorization defect.
Improper authentication in Dell ObjectScale versions prior to 4.4.0.0 allows remote, unauthenticated attackers to bypass authentication and gain unauthorized access to the platform, with full impact to confidentiality, integrity, and availability (CVSS 3.1 8.1 High). The High attack complexity (AC:H) indicates exploitation requires satisfying a non-trivial precondition - such as a timing window or a specific system state in the authentication flow - rather than a single deterministic request, and no public exploit code has been identified at time of analysis. Only deployments running ObjectScale 4.4.0.0 and later are remediated, so older installations exposed on reachable management or S3 interfaces should be prioritized for upgrade.
BIND 9 secondary (slave) servers that restrict zone transfers with TSIG can be tricked into serving attacker-supplied zone contents: an attacker able to occupy or spoof the position of the configured primary can deliver a multi-message TCP IXFR whose final TSIG-signed message never arrives, and named commits and serves the records already received without rolling back to the pre-transfer state. Affected releases are BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25, along with the -S1 builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; no valid TSIG key is required (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, 6.5), but exploitation is conditional on the attacker's network position and the multi-message IXFR condition, so this is an integrity-only, high-complexity issue rather than a broadly reachable critical flaw. No public exploit identified at time of analysis and no CISA KEV listing; vendor patches are downloadable for the 9.20 and 9.21 branches.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
Credential disclosure in Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier allows users who already hold Item/Configure permission to capture credentials they are not entitled to by authoring or modifying a Pipeline that invokes the resolveScm step, which fails to establish the correct context for credentials lookup. The issue is an access-control scoping flaw (CWE-863) rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting the authenticated Item/Configure prerequisite, the high complexity of targeting specific credential IDs, and impact limited to confidentiality with no integrity or availability effect. It requires a Jenkins instance that actually uses Pipeline/multibranch jobs with resolveScm; at time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the vendor advisory of 2026-09-16 should be reviewed for the fixed release.
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST /admin-api/crm/customer/send-sms and /send-mail, because CrmCustomerController does not enforce authorization on those actions. Publicly available exploit code exists, but exploitation requires a valid back-office account (PR:L), is remote with no user interaction, and yields only limited integrity impact; no confidentiality or availability impact is assessed. The practical risk is therefore concentrated on malicious insiders or attackers who have already obtained CRM credentials, not pre-auth compromise of default installations.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function returns early and bypasses those initializations. Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init() is called, a failure triggers amdgpu_ttm_fini(), which calls amdgpu_vram_mgr_fini(), which then: - Calls list_for_each_entry_safe() on reservations_pending and reserved_pages, whose list_head::next pointers are zero-initialized (NULL). The loop does not recognize them as empty and dereferences NULL. - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally via for_each_free_tree(). Since mm->free_trees is NULL (never allocated), this dereferences NULL. Both result in a kernel panic on the module load error path. Fix by moving drmm_cgroup_register_region() to after the list and buddy allocator are fully initialized, so the teardown path is safe to run.