Authentication Bypass
Monthly
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply notifications for arbitrary users by invoking the unprotected /web/comment/closeEmailNotification REST endpoint. The root cause is a missing authentication gate in WebSecurityConfig.java, which permits the endpoint to be reached without a session or credentials, directly writing a suppression flag into the Redis-backed user cache. A publicly available proof-of-concept exploit script exists, lowering the bar for mass or targeted abuse; no patch version has been identified at time of analysis.
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier.
Insecure Direct Object Reference in the Nexi XPay Build WordPress payment plugin (versions 7.6.1-7.6.2) exposes stored card token references and valid authorization signatures belonging to arbitrary customers to unauthenticated network attackers. The plugin's token retrieval endpoint performs no ownership verification, allowing any external actor to enumerate and retrieve payment credentials associated with other users' accounts. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the unauthenticated, zero-complexity vector makes automated harvesting trivial.
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) exposes configuration data to unauthenticated remote attackers. The authentication gate is enforced only in client-side code rather than on the server, allowing direct traversal to restricted pages without supplying credentials. An attacker with network access to the device's web interface can retrieve partial system configuration values - including likely network and device settings - without any login. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
Hash type confusion in Concrete CMS (below 9.5.3) allows cross-purpose token redemption: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to take over an account, or a password-reset hash can activate an unverified account. This is an amplifier vulnerability - exploitation requires the attacker to first acquire a valid hash through a separate channel such as email interception, log exposure, or SSRF against an internal mail relay, making it a force-multiplier for hash disclosure rather than a standalone attack path. No public exploit is identified and the vendor-assigned CVSS 4.0 score of 6.3 with AC:H and AT:P reflects the conditional nature of exploitation.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
Insufficient permission validation on management interfaces in Hikvision Wi-Fi series cameras allows authenticated low-privileged users to retrieve the device's Wi-Fi configuration via unauthorized API calls. The flaw stems from missing authorization checks on specific endpoints that expose network configuration data, potentially including SSID and pre-shared key material. Hikvision confirmed and addressed the issue in firmware V5.7.26; no public exploit or active exploitation is identified.
Improper encryption configuration across thirteen Hikvision video door station and intercom models enables physical-proximity attackers to forge MIFARE Classic (M1) access cards, bypassing the card-based authentication enforced by these devices. The vulnerability stems from weak or misconfigured Crypto-1 sector key handling in the card reader subsystem, allowing an attacker with commodity NFC tools to clone or synthesize valid credentials. With a forged card, an attacker can gain unauthorized physical entry to premises protected by these intercoms. No public exploit or CISA KEV listing is present, but MIFARE Classic attack tooling (Proxmark, libnfc) is mature and widely available.
Hard-coded API credentials embedded in DrEryk Gabinet's ticket reporting component allow any network-accessible attacker to authenticate directly to the ticket system API in versions before 11.5.0. Once the static credentials are known - through reverse engineering or public disclosure by CERT-PL - an attacker can perform privileged ticket operations including reading and modifying records beyond what the application's own permission model permits. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 11.5.0.
SP Property, a Joomla real estate listing extension by joomshaper.com, exposes gallery image management controller tasks without authorization checks or CSRF token validation in versions prior to 4.1.4. Unauthenticated remote attackers can invoke file deletion against arbitrary path strings and upload files of any type to the server. The unrestricted file upload primitive is particularly dangerous - if the upload directory is web-accessible, which is typical for Joomla component image managers, an attacker can deploy a PHP web shell and achieve full server-side code execution, making the realistic impact far more severe than the CVSS 4.0 score of 6.9 indicates.
Keycloak's Device Authorization Grant flow (RFC 8628) fails to enforce brute-force account lockout during token redemption, allowing an attacker holding an active device authorization session for a locked account to complete the flow and obtain valid access and refresh tokens. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all versions flagged in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the flaw silently undermines a core security control intended to stop credential-stuffing and persistent account compromise.
Header injection in webhookd prior to v1.22.0 allows unauthenticated remote attackers to impersonate authenticated users by supplying forged HTTP authentication headers when the Basic Auth middleware is disabled. The server blindly forwarded all incoming HTTP headers as shell variables to webhook script execution environments; without the Basic Auth (`htpasswd`) middleware active to sanitize the `X-WebAuthn-User` header, scripts relying on that variable for identity or privilege decisions could be manipulated. No public exploit identified at time of analysis; vendor-released patch available at v1.22.0.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
Missing authentication on the AJAX `addCategory` endpoint in Rizwan17's PHP inventory-management-system allows any unauthenticated remote attacker to invoke category management operations by manipulating the `userid` argument in `includes/process.php`. The CWE-287 root cause means the authentication gate is simply absent rather than bypassable through a logic flaw. A public exploit has been released, the maintainer has not responded to the responsible-disclosure issue, and no patch exists at time of analysis.
Missing authorization checks in the ruoyi-workflow module of RuoYi-Cloud-Plus 2.6.2 and earlier allow any authenticated user with a low-privilege account to read workflow task details belonging to other users via /task/getTask/{taskId} and to trigger workflow executions they are not entitled to start via /task/startWorkFlow. The FlwTaskController endpoints carry no permission annotations and the service layer never verifies that the caller is the task handler or a related user, so the only barrier is possession of a valid account. EPSS is low (0.19%, 9th percentile) and no CISA KEV listing or public exploit code has been identified at time of analysis, so this is a realistic internal-threat/insider and lateral-movement issue rather than an internet-wide emergency.
Unauthenticated manipulation of guest account settings in HPE Aruba ClearPass Policy Manager's (CPPM) web-based management interface allows remote attackers to extend guest network access beyond enforced policy limits. The flaw resides in the guest account management service and requires no credentials, no user interaction, and no special network position - only HTTP reachability to the management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity-only impact, but the policy-enforcement bypass angle elevates business risk in zero-trust or time-limited guest environments.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker occupying a network interception position to bypass TLS certificate checks, enabling unauthorized access to protected communications. Both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) variants are affected. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active exploitation has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) exposes organizations to protection mechanism bypass by unauthenticated remote attackers positioned on the network path. Affected are all Appliance versions prior to 5.36.00.16 and all Application versions prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382 and EUVD-2026-75026. The CVSS 3.7 Low score reflects high attack complexity - requiring man-in-the-middle positioning - with only limited confidentiality impact; no public exploit or active exploitation has been identified at time of analysis.
IP-based geo-restriction bypass in IP2Location Country Blocker for WordPress (all versions before 2.45.0) allows unauthenticated remote attackers to access restricted pages, links, or entire sites by forging the X-Real-IP HTTP header with an allowlisted IP address. The plugin resolves the client's country from this user-controlled header without validating it against the actual TCP connection source, making any IP-based access control rule trivially defeatable. No public exploit or active exploitation has been confirmed, but SSVC classifies the attack as automatable with partial technical impact.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 (both Appliance and Application deployment forms) allow a remote attacker who discovers those credentials to authenticate without legitimate access and retrieve sensitive information. Dell advisory DSA-2026-382 confirms patches for both variants: Appliance fixed at 5.36.00.16 and Application at 5.36.00.00. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in Snipe-IT before version 8.7.0 allows authenticated users holding only the assets.files permission to upload and delete file attachments on Asset Model records, which are shared catalog objects that normally require the separate models.files permission. The flaw in AssetModelPolicy causes the files() authorization method to cascade from the wrong permission scope, creating an unintended privilege boundary bypass. In multi-company Snipe-IT deployments, this enables cross-tenant mutation of shared Asset Model file attachments; no public exploit has been identified at time of analysis.
Incorrect authorization in Snipe-IT 8.2.0-8.6.x lets any authenticated user holding the users.edit permission toggle the activated flag on arbitrary accounts - including admin and superuser accounts - by submitting a complete PUT request to the single-user web UI edit route /users/{id}. Because UsersController::update() assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, the unauthorized write persisted through to save(); deactivating a targeted admin account locks it out of the application until re-enabled by another privileged user. No data is disclosed, and the API and bulk-edit paths are unaffected; the issue is fully remediated in 8.7.0.
Snipe-IT versions 4.2.0 through 8.6.3 allow any authenticated user with a web session to mint long-lived Laravel Passport bearer tokens via the auto-registered /oauth/personal-access-tokens route, even when an administrator has explicitly denied that user the self.api permission. The root cause is that Laravel Passport's OAuth routes carry only generic 'web' and 'auth:web' middleware, bypassing Snipe-IT's own can:self.api permission gate that protects the application's native token management endpoints. Crucially, the issued tokens remain subject to all existing per-endpoint authorization checks, so this is an authorization-control bypass that defeats administrative intent - not a privilege escalation. No public exploit has been identified at time of analysis, and a fix is available in version 8.7.0.
External control of critical state data in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive information to remote unauthenticated attackers via network-accessible state manipulation. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability degradation, per CVSS; no public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Unauthorized remote access to Dell Secure Connect Gateway 5.0 is enabled by a hard-coded cryptographic key embedded in both the Appliance and Application editions. An attacker who extracts this key - through binary analysis of the software - can leverage it to gain unauthorized access to protected resources, bypassing the confidentiality controls the cryptographic layer is intended to enforce. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch has been issued under Dell DSA-2026-382.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a remote low-privileged attacker to bypass cryptographic protection mechanisms, resulting in high confidentiality impact. Both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment modes are affected. Dell has released corrective updates via advisory DSA-2026-382, and no public exploit or active exploitation has been identified at time of analysis.
Missing authentication on a critical function in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to access protected functionality without credentials, resulting in unauthorized information disclosure. Both deployment forms are affected: the Appliance variant prior to 5.36.00.16 and the Application variant prior to 5.36.00.00. The CVSS 5.3 base score (C:L/I:N/A:N) indicates the immediate impact is limited to read-level unauthorized access; no public exploit code or CISA KEV listing exists at time of analysis.
JWT signature verification bypass in Dell Secure Connect Gateway 5.0 enables remote unauthenticated attackers to forge or tamper with cryptographically signed tokens, bypassing the product's authentication protection mechanisms. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 enables a network-positioned unauthenticated attacker to intercept encrypted communications via a man-in-the-middle attack, bypassing TLS-based trust mechanisms. Both the appliance form factor (versions prior to 5.36.00.16) and the virtual/application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.9 Medium rating reflects the high attack complexity imposed by the MITM positioning requirement.
Input data manipulation is possible in the Yordam Informatics Library Reservation System before v22.2 due to a missing authentication check on a critical function (CWE-306), reachable over the network by low-privileged authenticated users. The flaw enables integrity violations - altering reservation records or system data - without requiring elevated privileges or user interaction. Reported by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis.
Improper Authentication in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to bypass authentication controls and gain unauthorized access to protected resources, resulting in high confidentiality and integrity compromise. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit or CISA KEV listing has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a remote, unauthenticated attacker in a network-adjacent MITM position to bypass TLS protection mechanisms, potentially intercepting and altering communications between the SCG appliance or application and remote endpoints. Both deployment forms are affected - the physical/virtual appliance (versions prior to 5.36.00.16) and the software application (versions prior to 5.36.00.00). No public exploit or KEV listing exists; this is a medium-severity finding under CVSS 5.6 with high attack complexity reflecting the MITM positioning requirement.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthenticated attackers add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step. The `wpfnl_load_payment` AJAX action is exposed via `wp_ajax_nopriv_` with no nonce verification, no capability check, and no server-side validation confirming the caller-supplied `product_id` corresponds to the configured offer on the specified `step_id`. Exploitation enables systematic checkout price manipulation and direct merchant revenue loss; no public exploit identified at time of analysis.
Local information disclosure in Samsung Mobile's Watch Plugin for Android allows attackers with physical or local software access to read sensitive data from the device. Affected versions are all Watch Plugin releases prior to the Android Watch 17 patch, as confirmed by the Samsung Mobile security advisory. No active exploitation (not in CISA KEV) and no public proof-of-concept code are identified at time of analysis; the CVSS 4.0 score of 2.1 accurately reflects the constrained local-only, low-confidentiality-impact nature of this vulnerability.
Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. The flaw is limited to local access (AV:L) but requires no privileges, suggesting an exported Android component - such as a Content Provider, Activity, or Service - is reachable by any co-resident app without proper permission enforcement. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper access control in Samsung SystemUI prior to SMR Sep-2026 Release 1 permits any locally-executing attacker without elevated privileges to launch arbitrary Android activities on affected devices. Samsung Mobile Devices running Android 14 through 17 are affected, with the fix delivered in the September 2026 Monthly Security Release. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Improper authentication in Samsung's ActivityTaskManagerService allows local privileged attackers on affected Android devices to launch arbitrary activities, bypassing intended access controls. The flaw affects Samsung Mobile Devices running Android 14 through 17 and is addressed in the SMR Sep-2026 Release 1 patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the constrained local-privileged attack surface.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Incomplete cleanup in Google Chrome's Extensions subsystem (versions prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. The flaw (CWE-459) leaves residual access state after extension processing, which a specially crafted extension exploits to obtain capabilities beyond its declared permissions - yielding a high integrity impact with no confidentiality or availability consequence. No active exploitation has been confirmed, and EPSS stands at 0.28%, placing this squarely in routine patch priority territory.
The /chat WebSocket endpoint in n8n workflow automation platform fails to validate that a supplied resumeToken targets a chat-compatible node, allowing any holder of a valid token - including anonymous form submitters - to bypass Send-and-Wait, non-chat Human-in-the-Loop (HITL), and Wait approval gates in paused workflow executions. Affected versions are n8n below 2.37.7 and n8n 2.38.0-2.38.1, with vendor-confirmed fixes released 2026-09-02. No public exploit code or CISA KEV listing exists at time of analysis, but the integrity impact is directly relevant to organizations relying on n8n for sensitive human-approval workflows.
Auth0 AD/LDAP Connector versions 6.5.0 and earlier expose an administrative management panel on the local loopback interface with no authentication requirement, allowing any low-privileged local user or co-resident process to read plaintext Active Directory service account credentials and modify connector configuration without presenting credentials. The impact extends beyond the connector itself: exposed AD service account passwords enable lateral movement and privilege escalation within the broader Active Directory environment. No public exploit code or CISA KEV listing is recorded at time of analysis, but the attack requires only a basic HTTP client and local system access.
Token introspection cache in multi-tenant Quarkus OIDC configurations permits cross-tenant authorization bypass, allowing a bearer token issued by one OIDC provider to authenticate against endpoints secured by a different, independent OIDC provider. Affected are Enterprise Build of Quarkus versions 3.27.1-3.27.5 and 3.33.1-3.33.3 when both multi-tenant OIDC routing and the optional token introspection cache are active simultaneously. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV.
Unauthenticated schema mutation in Open-Web-Analytics 1.9.x allows remote attackers to invoke the base.updatesApply action - which applies database schema migrations - without any authentication or CSRF protection. The root cause is an opt-in authorization model in checkCapabilityAndAuthenticateUser(): controllers that omit setRequiredCapability() bypass authentication entirely, leaving the schema-mutation endpoint reachable by anyone. No public exploit or KEV listing exists; a patched release is available at version 1.10.0 via confirmed upstream commit.
Missing session authentication on vault unlock and recovery endpoints in moltis-org/moltis allows a remote unauthenticated attacker to attempt vault unsealing using only a stolen vault password or recovery key phrase, bypassing the intended dual-layer session-plus-credential security model. All versions through 20260818.10 are affected; the `/api/auth/*` path was globally allowlisted in `is_public_path()`, which caused the `AuthSession` middleware extractor to be silently skipped for both `vault_unlock_handler` and `vault_recovery_handler`. A proof-of-concept exists and vendor-released fix version 20260819.01 is available.
Header injection authentication bypass in Okta Access Gateway (versions prior to 2026.9.1) allows unauthenticated network attackers to impersonate any user identity by supplying a forged HTTP header when the optional pass-through authentication source is enabled without upstream header sanitization. The vulnerability (CWE-287) stems from the gateway's unconditional trust of a client-controlled HTTP header as an identity assertion, with no cryptographic binding or signature verification. No public exploit code has been identified at time of analysis; Okta has released a patched version (2026.9.1) via security advisory.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Hard-coded database credentials in ningzichun Student Management System expose MySQL connection secrets in the publicly accessible GitHub repository, allowing any attacker who reads the source to authenticate directly to the backend database. The vulnerability resides in config/database.php where mysqli_connect() is called with literal credential strings (CWE-259), affecting all commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Publicly available exploit code exists (E:P per the CVSS 4.0 supplemental); the project maintainer has not responded to the responsible disclosure issue.
Authentication bypass in aircheng-org iWebShop-5 (all versions 5.0-5.15) allows unauthenticated remote attackers to access the seller management panel by manipulating the `Name` parameter in the `Login` function of `controllers/systemseller.php`. A public exploit exists (referenced via GitHub issue #6), and SSVC confirms automatable exploitation with partial technical impact. The vendor has not responded to responsible disclosure, and no patch is available.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Unauthenticated network access to read-only PIMBoards endpoints in AVEVA Pipeline Integrity Monitor exposes operational data intended exclusively for authenticated PIMBoards users. The root cause is CWE-862 Missing Authorization - read paths lack access control enforcement, allowing any network-reachable attacker to retrieve restricted information without credentials. Write operations are explicitly unaffected, bounding the impact to confidentiality. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation as none and technical impact as partial.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Insufficiently protected credential transmission in Microsoft Office exposes NTLM or equivalent credential material to a network-adjacent attacker via a crafted document or resource link. Affected versions span the entire active Office portfolio - Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise - making the exposure broadly relevant. An unauthenticated remote attacker who can induce a user to open a specially crafted Office file or embedded resource can capture credential hashes suitable for relay or offline cracking, constituting a practical spoofing primitive. No public exploit code or CISA KEV listing has been identified at the time of analysis, though Microsoft has released patches.
Incorrect OAuth refresh token resource binding in n8n prior to 2.37.7 and 2.38.1 allows an attacker controlling a registered OAuth client to obtain valid access tokens for workflows they were never authorized to access. The first access token issued after user consent was correctly bound to the consented workflow resource, but the accompanying refresh token was not - at refresh time n8n only checked that the requested resource was a registered workflow, not that it matched the original consent grant. No public exploit code or CISA KEV listing has been identified at time of analysis; fixes are confirmed in released versions 2.37.7 and 2.38.1.
Insufficient authorization enforcement in the Credentials Manager of Nozomi Networks Guardian and CMC (Central Management Console) permits a remote authenticated user with limited privileges to view, delete, or modify credential entries beyond their intended access scope. Affected deployments running Guardian or CMC prior to version 26.3.0 are exposed to disruption of OT/ICS device authentication when entries are deleted, and to potential indirect credential capture when entry properties such as the authentication target are manipulated to redirect authentication attempts to attacker-controlled infrastructure. No public exploit code or CISA KEV listing exists; a vendor patch is available as of version 26.3.0.
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, enabling a locally authenticated low-privilege user to inject arbitrary process identifiers into the driver's trusted-process whitelist via a crafted IOCTL request. Bypassing this verification (CWE-782) allows the attacker's process to assume whitelisted trust status within the driver, gaining access to driver functions ordinarily restricted to ASUS's own software. No public exploit has been identified and the vendor-assigned CVSS 4.0 score of 2.0 reflects the constrained real-world impact: local-only access, high exploitation complexity, and limited integrity gain.
Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a local low-privileged user to hardware-level integrity and availability risks by bypassing the driver's IOCTL verification logic. All tracked versions of Armoury Crate are affected (CPE wildcard), meaning any Windows-based ASUS gaming system with the software installed is in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects the constrained local/high-complexity exploitation model.
Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly manipulate PCIe configuration space, enabling both hardware configuration disclosure and hardware disablement. The vulnerability stems from the kernel driver accepting IOCTL requests without validating caller privilege against the required access level, granting unprivileged processes read and write access to raw PCIe registers. No public exploit code has been identified at time of analysis, and no KEV listing exists, though the local nature of the attack limits the attack surface to already-compromised or multi-user systems.
Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly invoke the driver's System Management Interrupt (SMI) triggering capability, a function classified under CWE-749 as an exposed dangerous method. Repeatedly calling this function forces the CPU into System Management Mode in rapid succession, producing brief but repeatable system stalls that can escalate into a denial-of-service condition. No public exploit code exists and the vulnerability is not listed in CISA KEV, but ASUS has released a security advisory with an available fix.
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis.
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthenticated network attackers to register OAuth clients on servers that were configured to require an initial access token. The root cause is a fail-open pattern in resolve_secret/3: when a configured secret provider returned nil, false, or an empty string instead of a structured :error tuple, the function wrapped the value as {:ok, value} and passed it to the bearer-token comparison, causing that comparison to succeed against any request. No public exploit code has been identified, and the vendor has released a patched version (0.3.1).
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently reachable under a second, unintended URL prefix (`/.well-known`) due to Phoenix's `forward` macro stripping the matched prefix before dispatch, leaving both `/oauth` and `/.well-known` mounts backed by the same ProtocolRouter route table. POST requests to `/register`, `/token`, and `/revoke` therefore answer under `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`, bypassing any WAF rules, rate-limiting policies, or authentication exemptions scoped exclusively to the canonical `/oauth` prefix. No public exploit has been identified and the vulnerability is absent from CISA KEV; vendor patch version 0.3.1 is available.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
Certificate hostname validation bypass in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers positioned on the network path to perform man-in-the-middle attacks against TLS-protected communications. The flaw (CWE-297) means SCG accepts certificates whose hostname does not match the server being contacted, allowing an adversary to impersonate backend endpoints and intercept or manipulate encrypted traffic. No public exploit code has been identified, and the vulnerability has not been added to the CISA KEV catalog; however, the network-accessible attack vector and absence of required privileges make opportunistic interception feasible for network-adjacent adversaries.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 enable remote attackers to bypass authentication and access protected system functions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed affected per Dell advisory DSA-2026-382. Exploitation exposes sensitive information with high confidentiality impact, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply notifications for arbitrary users by invoking the unprotected /web/comment/closeEmailNotification REST endpoint. The root cause is a missing authentication gate in WebSecurityConfig.java, which permits the endpoint to be reached without a session or credentials, directly writing a suppression flag into the Redis-backed user cache. A publicly available proof-of-concept exploit script exists, lowering the bar for mass or targeted abuse; no patch version has been identified at time of analysis.
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier.
Insecure Direct Object Reference in the Nexi XPay Build WordPress payment plugin (versions 7.6.1-7.6.2) exposes stored card token references and valid authorization signatures belonging to arbitrary customers to unauthenticated network attackers. The plugin's token retrieval endpoint performs no ownership verification, allowing any external actor to enumerate and retrieve payment credentials associated with other users' accounts. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the unauthenticated, zero-complexity vector makes automated harvesting trivial.
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) exposes configuration data to unauthenticated remote attackers. The authentication gate is enforced only in client-side code rather than on the server, allowing direct traversal to restricted pages without supplying credentials. An attacker with network access to the device's web interface can retrieve partial system configuration values - including likely network and device settings - without any login. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
Hash type confusion in Concrete CMS (below 9.5.3) allows cross-purpose token redemption: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to take over an account, or a password-reset hash can activate an unverified account. This is an amplifier vulnerability - exploitation requires the attacker to first acquire a valid hash through a separate channel such as email interception, log exposure, or SSRF against an internal mail relay, making it a force-multiplier for hash disclosure rather than a standalone attack path. No public exploit is identified and the vendor-assigned CVSS 4.0 score of 6.3 with AC:H and AT:P reflects the conditional nature of exploitation.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
Insufficient permission validation on management interfaces in Hikvision Wi-Fi series cameras allows authenticated low-privileged users to retrieve the device's Wi-Fi configuration via unauthorized API calls. The flaw stems from missing authorization checks on specific endpoints that expose network configuration data, potentially including SSID and pre-shared key material. Hikvision confirmed and addressed the issue in firmware V5.7.26; no public exploit or active exploitation is identified.
Improper encryption configuration across thirteen Hikvision video door station and intercom models enables physical-proximity attackers to forge MIFARE Classic (M1) access cards, bypassing the card-based authentication enforced by these devices. The vulnerability stems from weak or misconfigured Crypto-1 sector key handling in the card reader subsystem, allowing an attacker with commodity NFC tools to clone or synthesize valid credentials. With a forged card, an attacker can gain unauthorized physical entry to premises protected by these intercoms. No public exploit or CISA KEV listing is present, but MIFARE Classic attack tooling (Proxmark, libnfc) is mature and widely available.
Hard-coded API credentials embedded in DrEryk Gabinet's ticket reporting component allow any network-accessible attacker to authenticate directly to the ticket system API in versions before 11.5.0. Once the static credentials are known - through reverse engineering or public disclosure by CERT-PL - an attacker can perform privileged ticket operations including reading and modifying records beyond what the application's own permission model permits. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 11.5.0.
SP Property, a Joomla real estate listing extension by joomshaper.com, exposes gallery image management controller tasks without authorization checks or CSRF token validation in versions prior to 4.1.4. Unauthenticated remote attackers can invoke file deletion against arbitrary path strings and upload files of any type to the server. The unrestricted file upload primitive is particularly dangerous - if the upload directory is web-accessible, which is typical for Joomla component image managers, an attacker can deploy a PHP web shell and achieve full server-side code execution, making the realistic impact far more severe than the CVSS 4.0 score of 6.9 indicates.
Keycloak's Device Authorization Grant flow (RFC 8628) fails to enforce brute-force account lockout during token redemption, allowing an attacker holding an active device authorization session for a locked account to complete the flow and obtain valid access and refresh tokens. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all versions flagged in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the flaw silently undermines a core security control intended to stop credential-stuffing and persistent account compromise.
Header injection in webhookd prior to v1.22.0 allows unauthenticated remote attackers to impersonate authenticated users by supplying forged HTTP authentication headers when the Basic Auth middleware is disabled. The server blindly forwarded all incoming HTTP headers as shell variables to webhook script execution environments; without the Basic Auth (`htpasswd`) middleware active to sanitize the `X-WebAuthn-User` header, scripts relying on that variable for identity or privilege decisions could be manipulated. No public exploit identified at time of analysis; vendor-released patch available at v1.22.0.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
Missing authentication on the AJAX `addCategory` endpoint in Rizwan17's PHP inventory-management-system allows any unauthenticated remote attacker to invoke category management operations by manipulating the `userid` argument in `includes/process.php`. The CWE-287 root cause means the authentication gate is simply absent rather than bypassable through a logic flaw. A public exploit has been released, the maintainer has not responded to the responsible-disclosure issue, and no patch exists at time of analysis.
Missing authorization checks in the ruoyi-workflow module of RuoYi-Cloud-Plus 2.6.2 and earlier allow any authenticated user with a low-privilege account to read workflow task details belonging to other users via /task/getTask/{taskId} and to trigger workflow executions they are not entitled to start via /task/startWorkFlow. The FlwTaskController endpoints carry no permission annotations and the service layer never verifies that the caller is the task handler or a related user, so the only barrier is possession of a valid account. EPSS is low (0.19%, 9th percentile) and no CISA KEV listing or public exploit code has been identified at time of analysis, so this is a realistic internal-threat/insider and lateral-movement issue rather than an internet-wide emergency.
Unauthenticated manipulation of guest account settings in HPE Aruba ClearPass Policy Manager's (CPPM) web-based management interface allows remote attackers to extend guest network access beyond enforced policy limits. The flaw resides in the guest account management service and requires no credentials, no user interaction, and no special network position - only HTTP reachability to the management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity-only impact, but the policy-enforcement bypass angle elevates business risk in zero-trust or time-limited guest environments.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker occupying a network interception position to bypass TLS certificate checks, enabling unauthorized access to protected communications. Both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) variants are affected. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active exploitation has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) exposes organizations to protection mechanism bypass by unauthenticated remote attackers positioned on the network path. Affected are all Appliance versions prior to 5.36.00.16 and all Application versions prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382 and EUVD-2026-75026. The CVSS 3.7 Low score reflects high attack complexity - requiring man-in-the-middle positioning - with only limited confidentiality impact; no public exploit or active exploitation has been identified at time of analysis.
IP-based geo-restriction bypass in IP2Location Country Blocker for WordPress (all versions before 2.45.0) allows unauthenticated remote attackers to access restricted pages, links, or entire sites by forging the X-Real-IP HTTP header with an allowlisted IP address. The plugin resolves the client's country from this user-controlled header without validating it against the actual TCP connection source, making any IP-based access control rule trivially defeatable. No public exploit or active exploitation has been confirmed, but SSVC classifies the attack as automatable with partial technical impact.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 (both Appliance and Application deployment forms) allow a remote attacker who discovers those credentials to authenticate without legitimate access and retrieve sensitive information. Dell advisory DSA-2026-382 confirms patches for both variants: Appliance fixed at 5.36.00.16 and Application at 5.36.00.00. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in Snipe-IT before version 8.7.0 allows authenticated users holding only the assets.files permission to upload and delete file attachments on Asset Model records, which are shared catalog objects that normally require the separate models.files permission. The flaw in AssetModelPolicy causes the files() authorization method to cascade from the wrong permission scope, creating an unintended privilege boundary bypass. In multi-company Snipe-IT deployments, this enables cross-tenant mutation of shared Asset Model file attachments; no public exploit has been identified at time of analysis.
Incorrect authorization in Snipe-IT 8.2.0-8.6.x lets any authenticated user holding the users.edit permission toggle the activated flag on arbitrary accounts - including admin and superuser accounts - by submitting a complete PUT request to the single-user web UI edit route /users/{id}. Because UsersController::update() assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, the unauthorized write persisted through to save(); deactivating a targeted admin account locks it out of the application until re-enabled by another privileged user. No data is disclosed, and the API and bulk-edit paths are unaffected; the issue is fully remediated in 8.7.0.
Snipe-IT versions 4.2.0 through 8.6.3 allow any authenticated user with a web session to mint long-lived Laravel Passport bearer tokens via the auto-registered /oauth/personal-access-tokens route, even when an administrator has explicitly denied that user the self.api permission. The root cause is that Laravel Passport's OAuth routes carry only generic 'web' and 'auth:web' middleware, bypassing Snipe-IT's own can:self.api permission gate that protects the application's native token management endpoints. Crucially, the issued tokens remain subject to all existing per-endpoint authorization checks, so this is an authorization-control bypass that defeats administrative intent - not a privilege escalation. No public exploit has been identified at time of analysis, and a fix is available in version 8.7.0.
External control of critical state data in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive information to remote unauthenticated attackers via network-accessible state manipulation. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability degradation, per CVSS; no public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Unauthorized remote access to Dell Secure Connect Gateway 5.0 is enabled by a hard-coded cryptographic key embedded in both the Appliance and Application editions. An attacker who extracts this key - through binary analysis of the software - can leverage it to gain unauthorized access to protected resources, bypassing the confidentiality controls the cryptographic layer is intended to enforce. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch has been issued under Dell DSA-2026-382.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a remote low-privileged attacker to bypass cryptographic protection mechanisms, resulting in high confidentiality impact. Both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment modes are affected. Dell has released corrective updates via advisory DSA-2026-382, and no public exploit or active exploitation has been identified at time of analysis.
Missing authentication on a critical function in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to access protected functionality without credentials, resulting in unauthorized information disclosure. Both deployment forms are affected: the Appliance variant prior to 5.36.00.16 and the Application variant prior to 5.36.00.00. The CVSS 5.3 base score (C:L/I:N/A:N) indicates the immediate impact is limited to read-level unauthorized access; no public exploit code or CISA KEV listing exists at time of analysis.
JWT signature verification bypass in Dell Secure Connect Gateway 5.0 enables remote unauthenticated attackers to forge or tamper with cryptographically signed tokens, bypassing the product's authentication protection mechanisms. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 enables a network-positioned unauthenticated attacker to intercept encrypted communications via a man-in-the-middle attack, bypassing TLS-based trust mechanisms. Both the appliance form factor (versions prior to 5.36.00.16) and the virtual/application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.9 Medium rating reflects the high attack complexity imposed by the MITM positioning requirement.
Input data manipulation is possible in the Yordam Informatics Library Reservation System before v22.2 due to a missing authentication check on a critical function (CWE-306), reachable over the network by low-privileged authenticated users. The flaw enables integrity violations - altering reservation records or system data - without requiring elevated privileges or user interaction. Reported by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis.
Improper Authentication in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to bypass authentication controls and gain unauthorized access to protected resources, resulting in high confidentiality and integrity compromise. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit or CISA KEV listing has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a remote, unauthenticated attacker in a network-adjacent MITM position to bypass TLS protection mechanisms, potentially intercepting and altering communications between the SCG appliance or application and remote endpoints. Both deployment forms are affected - the physical/virtual appliance (versions prior to 5.36.00.16) and the software application (versions prior to 5.36.00.00). No public exploit or KEV listing exists; this is a medium-severity finding under CVSS 5.6 with high attack complexity reflecting the MITM positioning requirement.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthenticated attackers add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step. The `wpfnl_load_payment` AJAX action is exposed via `wp_ajax_nopriv_` with no nonce verification, no capability check, and no server-side validation confirming the caller-supplied `product_id` corresponds to the configured offer on the specified `step_id`. Exploitation enables systematic checkout price manipulation and direct merchant revenue loss; no public exploit identified at time of analysis.
Local information disclosure in Samsung Mobile's Watch Plugin for Android allows attackers with physical or local software access to read sensitive data from the device. Affected versions are all Watch Plugin releases prior to the Android Watch 17 patch, as confirmed by the Samsung Mobile security advisory. No active exploitation (not in CISA KEV) and no public proof-of-concept code are identified at time of analysis; the CVSS 4.0 score of 2.1 accurately reflects the constrained local-only, low-confidentiality-impact nature of this vulnerability.
Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. The flaw is limited to local access (AV:L) but requires no privileges, suggesting an exported Android component - such as a Content Provider, Activity, or Service - is reachable by any co-resident app without proper permission enforcement. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper access control in Samsung SystemUI prior to SMR Sep-2026 Release 1 permits any locally-executing attacker without elevated privileges to launch arbitrary Android activities on affected devices. Samsung Mobile Devices running Android 14 through 17 are affected, with the fix delivered in the September 2026 Monthly Security Release. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Improper authentication in Samsung's ActivityTaskManagerService allows local privileged attackers on affected Android devices to launch arbitrary activities, bypassing intended access controls. The flaw affects Samsung Mobile Devices running Android 14 through 17 and is addressed in the SMR Sep-2026 Release 1 patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the constrained local-privileged attack surface.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Incomplete cleanup in Google Chrome's Extensions subsystem (versions prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. The flaw (CWE-459) leaves residual access state after extension processing, which a specially crafted extension exploits to obtain capabilities beyond its declared permissions - yielding a high integrity impact with no confidentiality or availability consequence. No active exploitation has been confirmed, and EPSS stands at 0.28%, placing this squarely in routine patch priority territory.
The /chat WebSocket endpoint in n8n workflow automation platform fails to validate that a supplied resumeToken targets a chat-compatible node, allowing any holder of a valid token - including anonymous form submitters - to bypass Send-and-Wait, non-chat Human-in-the-Loop (HITL), and Wait approval gates in paused workflow executions. Affected versions are n8n below 2.37.7 and n8n 2.38.0-2.38.1, with vendor-confirmed fixes released 2026-09-02. No public exploit code or CISA KEV listing exists at time of analysis, but the integrity impact is directly relevant to organizations relying on n8n for sensitive human-approval workflows.
Auth0 AD/LDAP Connector versions 6.5.0 and earlier expose an administrative management panel on the local loopback interface with no authentication requirement, allowing any low-privileged local user or co-resident process to read plaintext Active Directory service account credentials and modify connector configuration without presenting credentials. The impact extends beyond the connector itself: exposed AD service account passwords enable lateral movement and privilege escalation within the broader Active Directory environment. No public exploit code or CISA KEV listing is recorded at time of analysis, but the attack requires only a basic HTTP client and local system access.
Token introspection cache in multi-tenant Quarkus OIDC configurations permits cross-tenant authorization bypass, allowing a bearer token issued by one OIDC provider to authenticate against endpoints secured by a different, independent OIDC provider. Affected are Enterprise Build of Quarkus versions 3.27.1-3.27.5 and 3.33.1-3.33.3 when both multi-tenant OIDC routing and the optional token introspection cache are active simultaneously. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV.
Unauthenticated schema mutation in Open-Web-Analytics 1.9.x allows remote attackers to invoke the base.updatesApply action - which applies database schema migrations - without any authentication or CSRF protection. The root cause is an opt-in authorization model in checkCapabilityAndAuthenticateUser(): controllers that omit setRequiredCapability() bypass authentication entirely, leaving the schema-mutation endpoint reachable by anyone. No public exploit or KEV listing exists; a patched release is available at version 1.10.0 via confirmed upstream commit.
Missing session authentication on vault unlock and recovery endpoints in moltis-org/moltis allows a remote unauthenticated attacker to attempt vault unsealing using only a stolen vault password or recovery key phrase, bypassing the intended dual-layer session-plus-credential security model. All versions through 20260818.10 are affected; the `/api/auth/*` path was globally allowlisted in `is_public_path()`, which caused the `AuthSession` middleware extractor to be silently skipped for both `vault_unlock_handler` and `vault_recovery_handler`. A proof-of-concept exists and vendor-released fix version 20260819.01 is available.
Header injection authentication bypass in Okta Access Gateway (versions prior to 2026.9.1) allows unauthenticated network attackers to impersonate any user identity by supplying a forged HTTP header when the optional pass-through authentication source is enabled without upstream header sanitization. The vulnerability (CWE-287) stems from the gateway's unconditional trust of a client-controlled HTTP header as an identity assertion, with no cryptographic binding or signature verification. No public exploit code has been identified at time of analysis; Okta has released a patched version (2026.9.1) via security advisory.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Hard-coded database credentials in ningzichun Student Management System expose MySQL connection secrets in the publicly accessible GitHub repository, allowing any attacker who reads the source to authenticate directly to the backend database. The vulnerability resides in config/database.php where mysqli_connect() is called with literal credential strings (CWE-259), affecting all commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Publicly available exploit code exists (E:P per the CVSS 4.0 supplemental); the project maintainer has not responded to the responsible disclosure issue.
Authentication bypass in aircheng-org iWebShop-5 (all versions 5.0-5.15) allows unauthenticated remote attackers to access the seller management panel by manipulating the `Name` parameter in the `Login` function of `controllers/systemseller.php`. A public exploit exists (referenced via GitHub issue #6), and SSVC confirms automatable exploitation with partial technical impact. The vendor has not responded to responsible disclosure, and no patch is available.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Unauthenticated network access to read-only PIMBoards endpoints in AVEVA Pipeline Integrity Monitor exposes operational data intended exclusively for authenticated PIMBoards users. The root cause is CWE-862 Missing Authorization - read paths lack access control enforcement, allowing any network-reachable attacker to retrieve restricted information without credentials. Write operations are explicitly unaffected, bounding the impact to confidentiality. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation as none and technical impact as partial.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Insufficiently protected credential transmission in Microsoft Office exposes NTLM or equivalent credential material to a network-adjacent attacker via a crafted document or resource link. Affected versions span the entire active Office portfolio - Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise - making the exposure broadly relevant. An unauthenticated remote attacker who can induce a user to open a specially crafted Office file or embedded resource can capture credential hashes suitable for relay or offline cracking, constituting a practical spoofing primitive. No public exploit code or CISA KEV listing has been identified at the time of analysis, though Microsoft has released patches.
Incorrect OAuth refresh token resource binding in n8n prior to 2.37.7 and 2.38.1 allows an attacker controlling a registered OAuth client to obtain valid access tokens for workflows they were never authorized to access. The first access token issued after user consent was correctly bound to the consented workflow resource, but the accompanying refresh token was not - at refresh time n8n only checked that the requested resource was a registered workflow, not that it matched the original consent grant. No public exploit code or CISA KEV listing has been identified at time of analysis; fixes are confirmed in released versions 2.37.7 and 2.38.1.
Insufficient authorization enforcement in the Credentials Manager of Nozomi Networks Guardian and CMC (Central Management Console) permits a remote authenticated user with limited privileges to view, delete, or modify credential entries beyond their intended access scope. Affected deployments running Guardian or CMC prior to version 26.3.0 are exposed to disruption of OT/ICS device authentication when entries are deleted, and to potential indirect credential capture when entry properties such as the authentication target are manipulated to redirect authentication attempts to attacker-controlled infrastructure. No public exploit code or CISA KEV listing exists; a vendor patch is available as of version 26.3.0.
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, enabling a locally authenticated low-privilege user to inject arbitrary process identifiers into the driver's trusted-process whitelist via a crafted IOCTL request. Bypassing this verification (CWE-782) allows the attacker's process to assume whitelisted trust status within the driver, gaining access to driver functions ordinarily restricted to ASUS's own software. No public exploit has been identified and the vendor-assigned CVSS 4.0 score of 2.0 reflects the constrained real-world impact: local-only access, high exploitation complexity, and limited integrity gain.
Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a local low-privileged user to hardware-level integrity and availability risks by bypassing the driver's IOCTL verification logic. All tracked versions of Armoury Crate are affected (CPE wildcard), meaning any Windows-based ASUS gaming system with the software installed is in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects the constrained local/high-complexity exploitation model.
Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly manipulate PCIe configuration space, enabling both hardware configuration disclosure and hardware disablement. The vulnerability stems from the kernel driver accepting IOCTL requests without validating caller privilege against the required access level, granting unprivileged processes read and write access to raw PCIe registers. No public exploit code has been identified at time of analysis, and no KEV listing exists, though the local nature of the attack limits the attack surface to already-compromised or multi-user systems.
Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly invoke the driver's System Management Interrupt (SMI) triggering capability, a function classified under CWE-749 as an exposed dangerous method. Repeatedly calling this function forces the CPU into System Management Mode in rapid succession, producing brief but repeatable system stalls that can escalate into a denial-of-service condition. No public exploit code exists and the vulnerability is not listed in CISA KEV, but ASUS has released a security advisory with an available fix.
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis.
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthenticated network attackers to register OAuth clients on servers that were configured to require an initial access token. The root cause is a fail-open pattern in resolve_secret/3: when a configured secret provider returned nil, false, or an empty string instead of a structured :error tuple, the function wrapped the value as {:ok, value} and passed it to the bearer-token comparison, causing that comparison to succeed against any request. No public exploit code has been identified, and the vendor has released a patched version (0.3.1).
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently reachable under a second, unintended URL prefix (`/.well-known`) due to Phoenix's `forward` macro stripping the matched prefix before dispatch, leaving both `/oauth` and `/.well-known` mounts backed by the same ProtocolRouter route table. POST requests to `/register`, `/token`, and `/revoke` therefore answer under `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`, bypassing any WAF rules, rate-limiting policies, or authentication exemptions scoped exclusively to the canonical `/oauth` prefix. No public exploit has been identified and the vulnerability is absent from CISA KEV; vendor patch version 0.3.1 is available.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
Certificate hostname validation bypass in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers positioned on the network path to perform man-in-the-middle attacks against TLS-protected communications. The flaw (CWE-297) means SCG accepts certificates whose hostname does not match the server being contacted, allowing an adversary to impersonate backend endpoints and intercept or manipulate encrypted traffic. No public exploit code has been identified, and the vulnerability has not been added to the CISA KEV catalog; however, the network-accessible attack vector and absence of required privileges make opportunistic interception feasible for network-adjacent adversaries.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 enable remote attackers to bypass authentication and access protected system functions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed affected per Dell advisory DSA-2026-382. Exploitation exposes sensitive information with high confidentiality impact, and no active exploitation or public proof-of-concept has been identified at time of analysis.