Server
Monthly
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
Devolutions Server versions up to 2026.3.7.0 contain a missing authorization flaw in the global vault that allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. The issue requires valid credentials and a specific view grant, so it is primarily an insider or compromised-account risk rather than unauthenticated remote exploitation. No public exploit code has been identified, EPSS is low (0.17%), and the vendor has released a patch in version 2026.3.8.
Cleartext storage of external identity provider tokens and active session identifiers in the Devolutions Server backend database means anyone who already holds read access to those records can recover reusable credentials and replay them to impersonate users. The affected code is Devolutions Server 2026.3.5.0 and earlier; ENISA's EUVD entry narrows the affected range to all Server builds below 2026.3.7.0. Exploitation is gated by a significant prerequisite: the attacker must already have read access to the database tier, such as compromised database credentials, a leaked or stolen database backup, a privileged/malicious DBA, or a separate injection flaw, so the vendor rates it 7.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) while our assessment scores the same scope change with low attack complexity and limited integrity impact (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and the issue is not in CISA KEV. The real risk is post-disclosure: recovered session identifiers and IdP tokens remain valid for replay, which is why the scope change drives the elevated score despite the local, high-privilege prerequisite.
Cross-tenant information disclosure in Budibase Server before 3.45.0 allows an authenticated low-privilege user to read another tenant's application metadata and source code by supplying a victim tenant's app ID to the GET /api/applications/:appId/appPackage endpoint, which omits an ownership check. Successful exploitation exposes navigation structure, role names, internal screen URLs, embedded JavaScript snippets, and user identifiers belonging to the victim application. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); real-world risk is concentrated in multi-tenant hosted or shared self-hosted deployments where untrusted tenants coexist, while single-tenant deployments sharply limit impact.
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room, allowing anyone already holding Builder-level access to a workspace to passively capture database passwords and API keys whenever a collaborator saves or deletes a table on an external datasource. The exposure is confidentiality-dominant (CVSS 4.0 base 7.0; VC:H/VI:L/VA:N) and requires the privileged Builder role (PR:H) - it is not reachable by unauthenticated users or by low-privilege consumers of published apps. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in 3.45.0.
Authenticated privilege escalation in Budibase Server before 3.45.0 lets a low-privileged 'builder' account grant itself administrative roles in other workspaces. The flaw resides in the POST /api/global/groups/:groupId/apps endpoint, which fails to validate per-app authorization, allowing a builder who only has rights in one workspace to rewrite user-group role mappings for applications outside their own tenant boundary. Because the CVSS vector requires PR:L and no user interaction, exploitation is limited to authenticated builders, and a single-workspace or single-tenant instance offers no cross-boundary target; the raw 8.6 score therefore overstates the immediate threat even though the underlying authorization defect and its escalation impact are genuine. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a vendor patch is available in 3.45.0.
Broken workspace-level authorization in the Budibase server component before 3.45.0 allows an authenticated user holding builder access to a single workspace to enumerate chat identity link records belonging to every other workspace in the same tenant via a GET request to /api/chat-links. Exploitation discloses user IDs and external chat service identifiers for workspaces the builder is not permitted to access, but is read-only with no integrity or availability impact and no cross-tenant reach. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the real-world exposure is an insider or multi-workspace-tenant risk rather than an internet-wide threat.
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through 3.45.0, caused by an authentication bypass in the OIDC/SSO login path. In sso.authenticate, when no existing user matches the incoming SSO subject, the server resolves pending invites using only the IdP-asserted email address, skipping both invite-code validation and the email_verified check (which guards only the existing-account lookup), so anyone who can register at a trusted IdP and claim a victim's invited email - even with email_verified=false - consumes the invite and inherits its privileges, including builder and admin.global roles. Impact scales with the outstanding invite: an admin.global invite yields full tenant compromise (all apps, datasources with production credentials, automations) and the invite is consumed, denying onboarding to the legitimate invitee. Exploitation requires OIDC/SSO configured against a trusted IdP and an unclaimed pending invite matching the asserted email, per the vendor's AT:P attack-requirement modifier; no public exploit code or confirmed active exploitation was identified at time of analysis, and CVSS 4.0 rates this 9.2 with a CVSS 3.1 equivalent of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Second-order SQL injection in Budibase Server (@budibase/server) before 3.45.0 can let an authenticated attacker with DDL rights on a connected MySQL or MSSQL datasource create a malicious column name that escapes identifier quoting, then execute injected SQL when a Budibase builder later renames that column through the UI. Because the MySQL connection is opened with multipleStatements:true in this default case, stacked statements can run as the datasource user and bypass Budibase's row/table permission model, enabling arbitrary reads, writes, or destructive operations. No public exploit identified at time of analysis; vendor-released patch: 3.45.0.
Remote code execution via arbitrary file write affects Budibase Server versions before 3.45.0. An authenticated attacker holding the BUILDER role can upload a crafted ZIP to the PWA icon upload endpoint that exploits missing symlink validation during extraction, using leaf symlink entries followed by duplicate file entries to overwrite arbitrary files as root. This allows root-level code execution; no public exploit code has been identified at time of analysis, and the vulnerability is not reported as actively exploited.
Authenticated users holding the builder role in Budibase Server deployments before 3.45.0 can read arbitrary files from the host by submitting an OpenAPI/Swagger specification containing file:// external references to the data-source import endpoint, because the import validator never disables external JSON reference ($ref) resolution. Disclosed files include .env content and other configuration material holding JWT signing secrets, API keys and database credentials, so a read-only confidentiality bug can chain into full session forgery and downstream access to connected systems. Both the NVD-style CVSS 4.0 vector and our independent CVSS 3.1 assessment (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) require a valid builder-level account; there is no public exploit code identified at time of analysis and the CVE is not in CISA KEV, so exposure is bounded by how loosely builder accounts are provisioned - severe in shared or multi-tenant instances, lower in single-tenant deployments where builder seats are tightly held.
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.4.0 by sending a single unauthenticated-looking request to POST /api/auth/token, which issues full access and refresh JWTs without ever checking the account's twoFaEnabled flag. The flaw is only exploitable by an authenticated party in the sense that the attacker must already hold a valid username and password obtained through phishing or credential theft (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), and it only yields an advantage against accounts that actually have TOTP enabled; the parallel POST /api/auth/login endpoint enforces the second factor correctly. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, but because the bypass converts stolen passwords directly into long-lived session tokens, the practical risk is high wherever 2FA is the last line of defense.
Devolutions Server 2026.2.16 and earlier fails to properly validate the TLS certificate presented by a domain controller when the product authenticates against Active Directory over LDAPS, allowing an attacker positioned on the network path between the server and the DC to impersonate that DC and intercept privileged directory service credentials. The flaw is unauthenticated (CVSS PR:N) but requires an adjacent network vantage point (AV:A) plus meaningful interception complexity (AC:H) to pull off, and only environments that actually use the LDAPS/AD integration feature are exposed. No public exploit code has been identified at time of analysis and the EPSS score is very low at 0.12% (2nd percentile), so exploitation is conditional rather than opportunistic; the vendor advisory DEVO-2026-0030 is the authoritative source for fix guidance.
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated low-privileged users to abuse the query import endpoint, directing the server to fetch arbitrary attacker-supplied URLs - including cloud instance metadata endpoints such as AWS IMDSv1 (169.254.169.254) and equivalent GCP and Azure services. The attack is network-reachable with low complexity and no user interaction required, making it reliably exploitable by any authenticated Budibase user in cloud-hosted deployments where temporary credentials are accessible via metadata APIs. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization on license management REST endpoints in Budibase server before 3.41.3 allows any low-privilege authenticated user to delete license keys or manipulate offline tokens via /api/global/license/* - degrading or disabling premium features for the entire deployment. The flaw (CWE-862) is network-exploitable with low complexity and requires only a valid user account, making it accessible to the broadest possible authenticated audience within a deployment. No public exploit or CISA KEV listing exists at time of analysis, but the attack path is trivially reproducible given endpoint documentation.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated builder-level users to supply arbitrary URLs to the datasource verify endpoint without SSRF validation, causing the server to make outbound requests to attacker-controlled infrastructure. The primary impact is credential leakage: internal CouchDB connection credentials are exposed in those outbound requests, granting an attacker direct, full administrative access to the backend database. This risk is amplified in cloud deployments where CouchDB serves as the primary data store. No public exploit code or CISA KEV listing is identified at time of analysis.
Cross-application resource injection in Budibase Server before 3.41.3 allows any authenticated builder to plant tables, automations, queries, and screens into workspaces they have no authorized access to. The POST /api/resources/duplicate endpoint accepts an arbitrary destination workspace ID in the request body and performs no authorization check against the destination, enabling horizontal privilege escalation across workspace boundaries. Once malicious automations are injected, an attacker can trigger them to fire outbound webhooks relaying victim application data to attacker-controlled infrastructure, achieving data exfiltration. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.41.3.
Server-Side Request Forgery in Budibase Server self-hosted deployments exposes internal services on the RFC 6598 shared address space (100.64.0.0/10) by omitting that range from the default SSRF blacklist (DEFAULT_BLACKLIST) used for REST datasource query preview requests. Authenticated users holding the Builder role can submit a crafted POST /api/queries/preview request targeting a reachable host in 100.64.0.0/10, causing the Budibase server to proxy the request and return the internal service response through the preview flow, potentially exposing confidential internal data. No released patch has been identified; exploitation requires Builder-role access and a self-hosted deployment without a custom BLACKLIST_IPS override. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Budibase server before 3.41.3 allows an authenticated app-scoped builder to gain unauthorized builder access across all applications within the same tenant. By submitting crafted requests to the public user create or update API endpoints with manipulated builder.apps fields, the attacker bypasses the missing authorization check and self-assigns elevated builder privileges over unrelated applications. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the network-accessible, low-complexity nature of the attack makes this a significant risk in any multi-tenant Budibase deployment.
Authorization bypass in Budibase Server before 3.41.3 allows any authenticated user holding the lowest-privilege BASIC role to perform unrestricted read, create, update, and delete operations against any application table via the POST /api/datasources/query endpoint. Per-table role restrictions enforced elsewhere in the application are entirely absent on this API path, rendering the access control model trivially circumventable with a standard API call. No public exploit has been identified at time of analysis, though the low attack complexity - requiring only valid BASIC credentials and a crafted HTTP request - makes this a genuine priority for externally-accessible or multi-tenant deployments.
Authorization regression in Budibase v3.39.4 enables any authenticated BASIC user to generate S3 PutObject presigned URLs for arbitrary S3 buckets, bypassing the intended BUILDER-level permission gate on the attachment upload endpoint. The regression introduced in v3.39.4 - where the route guard was changed from `authorized(BUILDER)` to `authorized(PermissionType.TABLE, PermissionLevel.WRITE)` - gives all default BASIC users access to an endpoint that was explicitly restricted to builders. Compounding the issue, the endpoint accepts an attacker-controlled `bucket` parameter without validating it against the datasource's configured bucket, allowing writes to any S3 bucket reachable by the platform's stored IAM credentials. No public exploit tool exists at time of analysis, but the official GHSA advisory publishes complete reproduction steps and the test suite confirms the behavior, making exploitation trivial for any authenticated platform user.
NoSQL injection in Budibase Server's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) allows authenticated users with query write permission to bypass document-level filters and read, modify, or delete arbitrary MongoDB documents. The flaw stems from Handlebars interpolation being performed with escaping explicitly disabled (noEscaping: true), meaning JSON metacharacters in user-supplied parameters survive into the parsed query object that flows directly to MongoDB driver calls. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch commit and PR are publicly available on GitHub.
NoSQL injection in Budibase's MongoDB datasource integration (versions before 3.40.0) allows any authenticated BASIC user to bypass per-user query-level access controls by injecting MongoDB operators into query parameters. The root cause is Handlebars enrichment configured with `noEscaping: true` followed by `JSON.parse`, which promotes attacker-supplied `$`-prefixed operators directly into MongoDB query documents without filtering - enabling full collection dumps, server-side JavaScript execution via `$where`, and unauthorized update or delete operations. No public exploit has been identified at time of analysis, though upstream fix commits are available and the vulnerability targets a configuration pattern recommended in Budibase's own documentation.
Broken object-level authorization in the Hashtopolis server web-interface chunk activity component lets any authenticated low-privilege account read all cracked hashes across the entire server, regardless of access-group membership. Affecting all versions prior to 0.14.8, the flaw exposes recovered plaintext credentials - the core sensitive output of the platform - to users who should only see their own group's data. No public exploit is identified at time of analysis, but the vendor confirmed the issue and shipped a fix in v0.14.8.
Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor.
Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR.
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any other member's vault key and a victim-scoped access token. The POST /auth-requests/admin-request handler never verifies that the email in the request body belongs to the authenticated caller (CWE-639), so an attacker can create a Trusted Device Encryption admin-approval request for a victim, bound to an attacker-controlled public key; once approved, the encrypted key material is retrievable from an unauthenticated endpoint. Publicly available exploit code exists (a VulnCheck advisory plus a public write-up), and the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact plus a cross-user scope change.
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust availability of the platform, per vendor advisory TAN-2026-016. The flaw is network-reachable with low complexity and no privileges or user interaction (CVSS 7.5, availability-only impact), and the CWE-789 classification indicates an uncontrolled/excessive memory allocation can be triggered remotely. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a Custom role with the ManageUsers permission delete Admin accounts from the organization, undermining administrative control. The flaw stems from the bulk user-remove (DELETE) endpoint omitting the role-hierarchy guard that the single-user removal path enforces, so a lower-privileged user can strip Admins by submitting their organization-user IDs in a batch request. Publicly available exploit code exists (VulnCheck/researcher write-up), it is not listed in CISA KEV, and no EPSS score was provided in the input.
OS command injection in MariaDB Server (CWE-78) lets an attacker achieve remote code execution on Galera cluster nodes by embedding shell metacharacters in a joiner node's name, which the server passes unsanitized to the script defined in wsrep_notify_cmd. Affected branches are 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1, but only when wsrep_notify_cmd is configured. It carries a vendor CVSS of 9.8; however EPSS is very low (0.05%, 15th percentile) and SSVC marks exploitation as 'none', so there is no public exploit identified at time of analysis and it is not on CISA KEV.
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust resources and render the endpoint-management console unavailable, disrupting security operations across managed fleets. Rooted in a missing resource release (CWE-772), the flaw carries a 7.5 CVSS driven purely by availability impact, with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and EPSS probability is negligible at 0.03%. A vendor patch is available across the 7.6, 7.7, and 7.8 branches.
Credential disclosure in Devolutions Server (2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) lets a low-privileged authenticated user coerce the server's Active Directory browsing feature into authenticating against an attacker-controlled host, relaying the stored PAM provider service-account credentials. Classified as SSRF (CWE-918), it enables theft of privileged service-account authentication material that can then be abused against downstream systems. No public exploit identified at time of analysis; EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none.
Authentication bypass in Devolutions Server 2026.1.6.0 through 2026.1.16.0 lets an attacker who already knows a victim's password defeat that user's multi-factor authentication after the victim reconfigures their MFA factors, because factor key state is not properly reset. This is an authenticated (PR:L), user-interaction-dependent flaw (the victim must reconfigure factors) with total technical impact (full account takeover). It is not on CISA KEV and no public exploit identified at time of analysis; EPSS is very low at 0.05% (15th percentile).
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management privileges to retrieve or rotate organization SCIM API keys without master password re-authentication. An attacker with valid session credentials and SCIM management rights can obtain sensitive API keys that enable user provisioning control, potentially leading to unauthorized account creation, modification, or deletion within the organization. Public exploit code exists, and vendor patch v2026.4.1 addresses the issue via GitHub PR #7403.
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access, achieving complete administrative takeover. The vulnerability exploits a missing authorization check in the POST /providers/{providerId}/clients/existing endpoint, allowing authenticated provider users to add any organization to their provider without the target's consent. Publicly available exploit code exists (detailed writeup by Sanjok Karki), and vendor-released patch v2026.4.0 fully addresses the issue via GitHub PR #7372. Self-hosted installations are unaffected due to endpoint access restrictions. CVSS 8.9 reflects high confidentiality, integrity, and availability impact with high attack complexity and high privilege requirements.
Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time.
Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis.
Authenticated users can trigger a heap overflow in MariaDB 11.4 (before 11.4.10) and 11.8 (before 11.8.6) through the JSON_SCHEMA_VALID() function, causing denial of service and potentially remote code execution under specific memory layout conditions. The vulnerability requires valid database credentials and affects server availability and integrity across scope boundaries. No patch is currently available for vulnerable versions.
Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management.
An out-of-bounds memory read in MariaDB Server's spatial (GIS) functions lets an authenticated but low-privileged database user pass a truncated WKB MultiPolygon or MultiLineString to ST_Area, ST_Centroid, or GLength and have the parser read past the end of the allocated buffer, returning adjacent heap bytes as a geometry result or error path. Affected releases are MariaDB 10.6.1 through the fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires valid credentials and the ability to submit attacker-controlled spatial data (CVSS 4.3, PR:L), and the leak is primarily useful as an ASLR-bypass primitive inside a larger exploit chain rather than as a standalone compromise. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it should be treated as low-to-moderate priority and scheduled with routine patching; the vendor advisory GHSA-p7v9-24h4-mch8 and MDEV-40328 document the issue.
Missing FILE-privilege and secure_file_priv enforcement in MariaDB Server's optional CONNECT storage engine plugin lets an authenticated, low-privileged database user read or write files on the database host through the file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(), bypassing the access controls those functions were supposed to honor. Affected releases range from 10.6.1 up to (but excluding) the fixed builds 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires the CONNECT plugin to be installed and loaded (it is not part of a default MariaDB installation) plus a valid low-privileged account able to call the affected UDFs. The practical impact is bounded by the operating-system permissions of the database service account, so reachable files are limited to those the mysqld user can already read or write; no public exploit code has been identified at time of analysis, and the flaw is rated moderate (CVSS 3.1 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than an emergency.
Server-side request forgery in the PingOne groups endpoint of Devolutions Server 2026.3.8.0 and earlier lets an authenticated user with low privileges supply an attacker-controlled PingOne configuration in a request parameter and cause the server to act on it, resulting in exfiltration of the stored PingOne application secret. The issue carries a CVSS base score of 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), is limited to a confidentiality impact on the PingOne secret, and only affects instances where the PingOne integration is configured with a stored application secret. No public exploit code has been identified at time of analysis, and a vendor patch is available.
Authenticated PAM checkout users on Devolutions Server 2026.3.8.0 and earlier can manipulate the just-in-time (JIT) elevation settings embedded in a checkout update request to delete arbitrary Active Directory groups or preserve elevated privileges that should have been dropped at checkout. The flaw is a server-side trust issue: the application accepts client-supplied JIT elevation parameters without re-validating them, so an attacker only needs a provisioned account that already holds PAM checkout access. There is no public exploit identified at time of analysis, exploitation is not listed in CISA KEV, and the vendor has released a patched version; CVSS scores are modest (4.3 vendor base; independent assessment 4.3 with Scope:Changed, reflecting limited integrity and availability impact rather than confidentiality loss).
Incorrect authorization in Devolutions Server 2026.3.8.0 and earlier lets an authenticated user who holds only View permission on a connection retrieve stored add-on passwords, because the connection data returned to the client includes add-on properties unredacted rather than masked. Exploitation requires a pre-existing low-privilege account and only exposes secrets for connections that account can already view, so the impact is high-confidentiality but scoped to credentials stored in add-on properties; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor has released a fix, making this a genuine but moderate-priority information-disclosure issue rather than a critical emergency.
Improper access control in Devolutions Server 2026.3.8.0 and earlier lets an authenticated remote user who has only the general Edit permission - but who was explicitly not granted the Edit asset permission - change an asset's stored contact password by issuing a crafted request straight to the partial-save endpoint, skipping the UI-level authorization check (CWE-863). The consequence is confined to partial integrity loss (CVSS 4.3, AV:N/AC:L/PR:L/UI:N, C:N/I:L/A:N): no data disclosure or availability impact, and the attacker must already hold a valid account with Edit rights, so this is not a privilege-escalation path to full administrative control. No KEV listing, no active exploitation and no public exploit code were identified at time of analysis, and SSVC/EPSS-style signals (Exploitation: none, Automatable: no, Technical Impact: partial) place this at low real-world priority; the flaw is fixed in 2026.3.10.
Account takeover in Gotify server versions prior to 3.0.0 allows an authenticated attacker who possesses a valid client token to change the associated user's password without providing the current password or an elevated authentication step. This CWE-620 (Unverified Password Change) flaw gives the attacker control of password authentication for the account, potentially locking out the legitimate user and forcing recovery through an administrator or direct database access. The vulnerability is fixed in version 3.0.0, and no public exploit code or active exploitation has been identified at time of analysis.
Privilege confusion in MariaDB Server (10.6.1 through the 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.x and 13.0.x lines prior to the fixed releases) allows an authenticated attacker who already holds the CREATE USER privilege to create a principal whose name collides with an existing role or localhost user in the database-privilege ACL cache, then exercise database privileges belonging to that other account. Because roles and localhost users were both cached with an empty IP component, the cache key could resolve to the wrong principal once the legitimate account's database privileges had already been cached through normal use, matching the assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (high confidentiality and integrity impact, no availability impact). Exploitation is not reachable by unauthenticated or low-privilege users and depends on non-trivial account-naming collisions plus ACL-cache timing state, so the practical risk is concentrated in privileged insiders or already-compromised administrative accounts. Vendor-released fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; no public exploit identified at time of analysis.
Out-of-bounds reads in MariaDB Server's legacy mysql_json plugin can expose memory contents or crash the server when the plugin parses a specially crafted MySQL-origin table containing invalid MySQL binary JSON. The flaw affects MariaDB 10.6.1 and later branches up to (but excluding) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is only reachable when tables imported from MySQL must be read through the mysql_json compatibility path - for example during ALTER TABLE ... FORCE. The CVSS vector (AV:L, PR:N, UI:R, S:U, C:L, I:N, A:L, score 4.4) confirms this is a local, interaction-driven issue rather than a remotely exploitable one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available.
Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.
Account takeover is possible in Devolutions Server 2026.3.7.0 and earlier through an authentication bypass in the OAuth device authorization (device code) flow, in which a captured device verification link can be replayed to bind an attacker-controlled client to a victim's account. The flaw is rated 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N): the attacker needs no credentials, but must first obtain a valid, still-replayable verification link and then rely on an already-authenticated victim interacting with it, which keeps attack complexity high and exploitation dependent on user behavior. Exploitation has not been observed (CISA SSVC reports Exploitation: none, Automatable: no) and no public exploit identified at time of analysis; Devolutions has released a fix in Server 2026.3.8.
Account takeover in Devolutions Server 2026.3.7.0 and earlier is possible through the Azure AD external login flow: an attacker positioned on an adjacent network segment (AV:A) can capture a login-session token that is exposed in the OAuth redirect URL and replay it to hijack the victim's account. Exploitation is limited to deployments where Azure AD external login is actually configured, and it requires intercepting a live, still-valid token during a genuine user login (AC:H), though no victim interaction with the attacker is needed (UI:N, PR:N). Independent signals are currently low - no public exploit identified at time of analysis, not listed in CISA KEV, EPSS 0.22% (11th percentile), and CISA SSVC records Exploitation: none and Automatable: no - but the vendor has released a patch and SSVC rates technical impact as total, so this is a genuine, moderate-priority issue rather than a top-tier emergency.
Missing authorization in the attachment history API of Devolutions Server 2026.3.5.0 and earlier lets an authenticated low-privileged user permanently delete or restore vault attachments by sending a crafted API request. The flaw requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base score 5.4) and is limited to integrity and availability of attachment data - there is no confidentiality exposure and no code execution. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor patch is available in Devolutions Server 2026.3.7.0.
Devolutions Server versions up to 2026.3.5.0 contain a missing authorization flaw in the data source settings API that lets an authenticated, non-administrative user craft a request to disclose stored integration secrets. The vulnerability requires low-privileged credentials (PR:L) and network access, yielding high confidentiality impact with no integrity or availability effect (CVSS 6.5). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a patched version 2026.3.7.0.
Improper access control in the partial connection API of Devolutions Server (reported as 2026.3.5.0 and earlier; EUVD tracks all builds prior to 2026.3.7.0) lets an authenticated low-privileged user read, create, modify, and delete System Vault entries through a crafted API request. Exploitation requires valid credentials on the instance plus network reachability to the endpoint, with no user interaction and no non-default configuration needed; the notable concern is integrity of the stored privileged secrets, reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L and an overall MEDIUM rating rather than a high-severity emergency. No public exploit code has been identified and SSVC records Exploitation: none, so there is no evidence of active exploitation at time of analysis; a vendor fix is available in 2026.3.7.0.
Devolutions Server versions prior to 2026.3.7.0 contain an improper rule enforcement flaw in the PAM Active Directory provider that allows an authenticated user with PAM edit permissions to bypass Devolutions Gateway host rulesets, potentially exposing restricted hosts to unauthorized access. This low-severity (CVSS 4.3) authorization-scoping weakness requires specific configuration-the PAM AD provider and a Gateway host ruleset-and no public exploit or active exploitation has been identified at time of analysis. The primary impact is a limited confidentiality breach.
Unauthenticated server-side request forgery in Budibase's Microsoft Teams webhook endpoint (all Budibase Server releases before 3.45.0) lets remote attackers submit a forged Bot Framework activity containing an arbitrary serviceUrl that the server persists and then reuses for every subsequent outbound bot reply. Those replies carry live Microsoft OAuth access tokens in their Authorization headers, so the server ultimately transmits credentials to the attacker's host and can also be steered into blind requests against internal network resources. The flaw is network-reachable and needs no authentication or user interaction (CVSS 4.0 PR:N/UI:N/AV:N), but exploitation is tempered by high attack complexity (AC:H) because a structurally valid activity payload is required and the attacker must win the persistence-then-reply flow; the endpoint is only exposed where the Microsoft Teams bot integration is configured and reachable, and no public exploit has been identified at time of analysis.
Sync-in Server versions prior to 2.4.1 leak account existence through a timing side channel in the login endpoint, allowing unauthenticated remote attackers to enumerate valid usernames or email addresses. The issue arises because login attempts for nonexistent accounts return early without running the bcrypt comparison performed for real accounts, producing a measurable difference in response times. This is a low-severity information-disclosure weakness (CVSS 5.3) that reveals only whether an account is registered, but can be chained into credential-stuffing, password-spraying, or phishing attacks; no public exploit identified at time of analysis.
An authenticated user of Sync-in Server (any version prior to 2.4.0) can render the entire instance unresponsive indefinitely by submitting a catastrophic-backtracking regular expression to the sync diff endpoint, which compiles the user-supplied string into a RegExp without complexity validation. Because Node.js runs JavaScript on a single shared event loop, a pattern such as '^(a+)+b' stalls processing for all connected users, and the service remains frozen until the container is manually restarted - an availability-only impact rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Version 2.4.0 fixes the issue; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Sync-in Server versions prior to 2.4.0 fail to increment the failed-attempt counter when a valid username and password are paired with an incorrect TOTP code on the desktop sync registration endpoint (POST /api/app/sync/register), so the account lockout threshold of 10 is never reached. An attacker who already possesses working first-factor credentials-and is targeting an account with 2FA enabled-can repeatedly guess the rotating 6-digit TOTP without triggering lockout; a successful guess yields a client ID and token that can be exchanged for a full JWT, after which the attacker can call POST /api/auth/2fa/disable to permanently remove MFA. Exploitation requires authenticated access (PR:L) and the high attack complexity (AC:H) reflects the need to guess a time-based code within its short validity window; no public exploit identified at time of analysis. This is a real, credible authentication-security issue but not a mass-exploitation emergency.
File owners on Nextcloud Server cannot release TYPE_TOKEN file locks that other users have placed on their files, leaving the file locked with no in-product recovery path; administrators currently have to clear the orphaned lock directly in the database. The defect is an access-control gap (CWE-284) reachable over the network by any authenticated user who can acquire a token lock, typically in shared-folder or multi-user collaboration scenarios, and it is availability-only - no confidentiality or integrity impact - as reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. No public exploit code has been identified and there is no evidence of active exploitation, so despite a 6.5 base score this behaves as an accidental or malicious file-lockout rather than a scalable remote attack.
Authorization bypass in Nextcloud Server (Circles feature) lets an authenticated user retrieve the membership list of a circle they do not belong to, exposing membership information for Nextcloud Server 32.0.0 through 34.0.0, as detailed in HackerOne report 3484601. Exploitation is gated by a severe practical constraint: the attacker must supply an existing circle's unique identifier, which lives in a 62^15-space (roughly 90-bit) keyspace, so the CVSS 3.1 score reflects high attack complexity rather than an easily reachable bypass and no public exploit has been identified at time of analysis. Impact is limited to confidentiality of one circle's member list; no modification, deletion, or service disruption is possible, making this a low-priority issue for most deployments.
Metadata disclosure in Nextcloud Server's Photos app smart albums allows an authenticated user to enumerate file names, IDs, and other metadata from a sharer's folders that were never intended to be included in the shared album. This moderate, tightly scoped authorization flaw (CWE-284) occurs because the smart album builds its file listing using the viewing user's photosSourceFolders search configuration instead of the album owner's configuration; an attacker who has been granted a filter-based smart album share can modify their own folder settings to widen the search scope. No public exploit code is identified at time of analysis, and the independent assessment limits impact to metadata (not file content) within the filter-reachable scope; it cannot reach files of users who have not shared such an album.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may inject forged, arbitrarily backdated event entries into organizations they have no membership in by sending crafted POST /collect API requests. All self-hosted Bitwarden Server instances prior to version 2026.7.2 are affected. A publicly available proof-of-concept exploit exists per researcher Sanjok Karki's blog post; no active exploitation has been confirmed in CISA KEV, but the low exploitation barrier and available PoC make patching urgent for compliance-sensitive deployments.
Improper authorization in Devolutions Server's secure messages deletion endpoint exposes an Insecure Direct Object Reference (IDOR) flaw allowing any authenticated user to permanently delete secure messages belonging to other users simply by supplying a target message identifier. Affected versions are 2026.2.11 and 2026.1.22; patched releases 2026.1.23 and 2026.2.12 are available per the vendor advisory. No public exploit identified at time of analysis, and the low CVSS score of 3.1 reflects constrained impact (integrity only, no data disclosure) paired with high attack complexity.
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
JSON injection in Bitwarden Server's IntegrationTemplateProcessor.ReplaceTokens() allows authenticated organization members to corrupt event-integration payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints. Any organization running Bitwarden Server prior to 2026.5.0 that has configured event integrations referencing user-controlled tokens such as #ActingUserName# or #UserName# is exposed. A public proof-of-concept exists per VulnCheck and independent researcher disclosure; exploitation is constrained by authentication and specific integration-configuration prerequisites, reflected in the low CVSS 4.0 score of 2.3.
Broken access control in Bitwarden Server before 2026.5.0 exposes organization billing data to any authenticated user via an IDOR vulnerability in the PreviewInvoiceController endpoints. The missing ManageOrganizationBillingRequirement authorization check permits a valid session holder to supply an arbitrary organizationId and retrieve Stripe-derived billing details - including tax totals, subscription status, and customer data - for organizations they do not belong to. A public proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at the time of analysis.
NTLM credential coercion in Devolutions Server 2026.2.4.0 through 2026.2.6.x allows an authenticated user with the UserGroupsView permission to redirect PAM Active Directory discovery requests to an attacker-controlled host, capturing PAM provider service account credentials as NTLMv2 challenge-response hashes. The vulnerability exists within the PAM AD discovery endpoints and is triggered by supplying a crafted DomainName parameter that causes the server to initiate an outbound NTLM authentication handshake. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS is 0.22% (12th percentile), indicating very low current exploitation probability.
Command injection (CWE-78) in Devolutions Server's built-in PAM provider password rotation templates allows an attacker with vault write access to execute arbitrary OS commands on systems managed by the affected PAM provider. Affected versions include 2026.2.4.0 and all releases at or below 2026.1.20.0, reported directly by the vendor Devolutions. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the high-value nature of a PAM platform managing privileged credentials on downstream systems means the practical blast radius substantially exceeds what the CVSS C:L/I:L scores suggest.
Missing authorization on the deleted user groups API in Devolutions Server enables authenticated low-privileged users to enumerate metadata of deleted user groups via crafted API requests, bypassing intended access controls. Affected deployments include versions 2026.2.4.0 and 2026.1.20.0 and earlier, as confirmed by the vendor advisory DEVO-2026-0015. No public exploit exists and CISA SSVC confirms no active exploitation, placing this at low operational priority despite its network-accessible attack vector.
Cleartext credential exposure in Devolutions Server allows an authenticated low-privileged user to retrieve plaintext credentials stored for configured ticketing integrations via a crafted API request. Affected versions include Devolutions Server 2026.2.4.0 and all 2026.1.x releases up to and including 2026.1.20.0. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-disclosed by Devolutions via advisory DEVO-2026-0015.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated low-privilege user to delete PAM network discovery scan configurations that should be restricted to administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only a valid low-privilege account over the network with no user interaction. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated user holding entry edit privileges to modify asset information beyond their authorized scope, bypassing the permission validation layer. The flaw resides in the permission validation component and enables privilege overreach within the platform's access control model - an authenticated low-privilege user can alter data they should have no write access to. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in Devolutions Server's entry status management feature allows authenticated non-administrator users to circumvent an administrator-enforced Pending Approval workflow, gaining unauthorized access to protected entry data through a crafted status change request. Affected versions span the entire 2025.3.x line through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 to 2026.1.16.0, as confirmed by Devolutions advisory DEVO-2026-0013. No public exploit has been identified and EPSS sits at 0.03% (7th percentile), indicating negligible observed exploitation activity; SSVC corroborates no known exploitation at time of analysis.
Devolutions Server's entry activity log feature fails to enforce per-permission authorization on its API layer, allowing authenticated users to retrieve audit trails for vault entries they can access but are explicitly denied log-viewing rights on. Affected are all Devolutions Server releases through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 through 2026.1.16.0. No public exploit code exists and EPSS sits at 0.03% (7th percentile), placing real-world exploitation risk firmly in the low tier despite the network-reachable attack vector.
Sealed-entry audit bypass in Devolutions Server allows an authenticated high-privileged user to silently retrieve sensitive data from protected vault entries without generating the expected unseal audit notification, undermining privileged access oversight controls. Affected versions span all releases through 2025.3.20.0 and the 2026.1.6.0 to 2026.1.16.0 range. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the compliance and insider-threat implications are significant in PAM environments where sealed-entry audit trails are the primary detection mechanism for sensitive credential access.
Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.
Missing authorization on the profile update API in Devolutions Server allows any authenticated Active Directory user to modify their own profile attributes beyond their permitted scope via a crafted API request. Affected are versions 2025.3.20.0 and earlier and 2026.1.6.0 through 2026.1.16.0. No public exploit has been identified and EPSS sits at 0.03% (8th percentile), but any AD-authenticated user with network reach to the API can tamper with profile data without additional privilege.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
Devolutions Server versions up to 2026.3.7.0 contain a missing authorization flaw in the global vault that allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. The issue requires valid credentials and a specific view grant, so it is primarily an insider or compromised-account risk rather than unauthenticated remote exploitation. No public exploit code has been identified, EPSS is low (0.17%), and the vendor has released a patch in version 2026.3.8.
Cleartext storage of external identity provider tokens and active session identifiers in the Devolutions Server backend database means anyone who already holds read access to those records can recover reusable credentials and replay them to impersonate users. The affected code is Devolutions Server 2026.3.5.0 and earlier; ENISA's EUVD entry narrows the affected range to all Server builds below 2026.3.7.0. Exploitation is gated by a significant prerequisite: the attacker must already have read access to the database tier, such as compromised database credentials, a leaked or stolen database backup, a privileged/malicious DBA, or a separate injection flaw, so the vendor rates it 7.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) while our assessment scores the same scope change with low attack complexity and limited integrity impact (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and the issue is not in CISA KEV. The real risk is post-disclosure: recovered session identifiers and IdP tokens remain valid for replay, which is why the scope change drives the elevated score despite the local, high-privilege prerequisite.
Cross-tenant information disclosure in Budibase Server before 3.45.0 allows an authenticated low-privilege user to read another tenant's application metadata and source code by supplying a victim tenant's app ID to the GET /api/applications/:appId/appPackage endpoint, which omits an ownership check. Successful exploitation exposes navigation structure, role names, internal screen URLs, embedded JavaScript snippets, and user identifiers belonging to the victim application. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); real-world risk is concentrated in multi-tenant hosted or shared self-hosted deployments where untrusted tenants coexist, while single-tenant deployments sharply limit impact.
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room, allowing anyone already holding Builder-level access to a workspace to passively capture database passwords and API keys whenever a collaborator saves or deletes a table on an external datasource. The exposure is confidentiality-dominant (CVSS 4.0 base 7.0; VC:H/VI:L/VA:N) and requires the privileged Builder role (PR:H) - it is not reachable by unauthenticated users or by low-privilege consumers of published apps. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in 3.45.0.
Authenticated privilege escalation in Budibase Server before 3.45.0 lets a low-privileged 'builder' account grant itself administrative roles in other workspaces. The flaw resides in the POST /api/global/groups/:groupId/apps endpoint, which fails to validate per-app authorization, allowing a builder who only has rights in one workspace to rewrite user-group role mappings for applications outside their own tenant boundary. Because the CVSS vector requires PR:L and no user interaction, exploitation is limited to authenticated builders, and a single-workspace or single-tenant instance offers no cross-boundary target; the raw 8.6 score therefore overstates the immediate threat even though the underlying authorization defect and its escalation impact are genuine. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a vendor patch is available in 3.45.0.
Broken workspace-level authorization in the Budibase server component before 3.45.0 allows an authenticated user holding builder access to a single workspace to enumerate chat identity link records belonging to every other workspace in the same tenant via a GET request to /api/chat-links. Exploitation discloses user IDs and external chat service identifiers for workspaces the builder is not permitted to access, but is read-only with no integrity or availability impact and no cross-tenant reach. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the real-world exposure is an insider or multi-workspace-tenant risk rather than an internet-wide threat.
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through 3.45.0, caused by an authentication bypass in the OIDC/SSO login path. In sso.authenticate, when no existing user matches the incoming SSO subject, the server resolves pending invites using only the IdP-asserted email address, skipping both invite-code validation and the email_verified check (which guards only the existing-account lookup), so anyone who can register at a trusted IdP and claim a victim's invited email - even with email_verified=false - consumes the invite and inherits its privileges, including builder and admin.global roles. Impact scales with the outstanding invite: an admin.global invite yields full tenant compromise (all apps, datasources with production credentials, automations) and the invite is consumed, denying onboarding to the legitimate invitee. Exploitation requires OIDC/SSO configured against a trusted IdP and an unclaimed pending invite matching the asserted email, per the vendor's AT:P attack-requirement modifier; no public exploit code or confirmed active exploitation was identified at time of analysis, and CVSS 4.0 rates this 9.2 with a CVSS 3.1 equivalent of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Second-order SQL injection in Budibase Server (@budibase/server) before 3.45.0 can let an authenticated attacker with DDL rights on a connected MySQL or MSSQL datasource create a malicious column name that escapes identifier quoting, then execute injected SQL when a Budibase builder later renames that column through the UI. Because the MySQL connection is opened with multipleStatements:true in this default case, stacked statements can run as the datasource user and bypass Budibase's row/table permission model, enabling arbitrary reads, writes, or destructive operations. No public exploit identified at time of analysis; vendor-released patch: 3.45.0.
Remote code execution via arbitrary file write affects Budibase Server versions before 3.45.0. An authenticated attacker holding the BUILDER role can upload a crafted ZIP to the PWA icon upload endpoint that exploits missing symlink validation during extraction, using leaf symlink entries followed by duplicate file entries to overwrite arbitrary files as root. This allows root-level code execution; no public exploit code has been identified at time of analysis, and the vulnerability is not reported as actively exploited.
Authenticated users holding the builder role in Budibase Server deployments before 3.45.0 can read arbitrary files from the host by submitting an OpenAPI/Swagger specification containing file:// external references to the data-source import endpoint, because the import validator never disables external JSON reference ($ref) resolution. Disclosed files include .env content and other configuration material holding JWT signing secrets, API keys and database credentials, so a read-only confidentiality bug can chain into full session forgery and downstream access to connected systems. Both the NVD-style CVSS 4.0 vector and our independent CVSS 3.1 assessment (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) require a valid builder-level account; there is no public exploit code identified at time of analysis and the CVE is not in CISA KEV, so exposure is bounded by how loosely builder accounts are provisioned - severe in shared or multi-tenant instances, lower in single-tenant deployments where builder seats are tightly held.
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.4.0 by sending a single unauthenticated-looking request to POST /api/auth/token, which issues full access and refresh JWTs without ever checking the account's twoFaEnabled flag. The flaw is only exploitable by an authenticated party in the sense that the attacker must already hold a valid username and password obtained through phishing or credential theft (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), and it only yields an advantage against accounts that actually have TOTP enabled; the parallel POST /api/auth/login endpoint enforces the second factor correctly. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, but because the bypass converts stolen passwords directly into long-lived session tokens, the practical risk is high wherever 2FA is the last line of defense.
Devolutions Server 2026.2.16 and earlier fails to properly validate the TLS certificate presented by a domain controller when the product authenticates against Active Directory over LDAPS, allowing an attacker positioned on the network path between the server and the DC to impersonate that DC and intercept privileged directory service credentials. The flaw is unauthenticated (CVSS PR:N) but requires an adjacent network vantage point (AV:A) plus meaningful interception complexity (AC:H) to pull off, and only environments that actually use the LDAPS/AD integration feature are exposed. No public exploit code has been identified at time of analysis and the EPSS score is very low at 0.12% (2nd percentile), so exploitation is conditional rather than opportunistic; the vendor advisory DEVO-2026-0030 is the authoritative source for fix guidance.
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated low-privileged users to abuse the query import endpoint, directing the server to fetch arbitrary attacker-supplied URLs - including cloud instance metadata endpoints such as AWS IMDSv1 (169.254.169.254) and equivalent GCP and Azure services. The attack is network-reachable with low complexity and no user interaction required, making it reliably exploitable by any authenticated Budibase user in cloud-hosted deployments where temporary credentials are accessible via metadata APIs. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization on license management REST endpoints in Budibase server before 3.41.3 allows any low-privilege authenticated user to delete license keys or manipulate offline tokens via /api/global/license/* - degrading or disabling premium features for the entire deployment. The flaw (CWE-862) is network-exploitable with low complexity and requires only a valid user account, making it accessible to the broadest possible authenticated audience within a deployment. No public exploit or CISA KEV listing exists at time of analysis, but the attack path is trivially reproducible given endpoint documentation.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated builder-level users to supply arbitrary URLs to the datasource verify endpoint without SSRF validation, causing the server to make outbound requests to attacker-controlled infrastructure. The primary impact is credential leakage: internal CouchDB connection credentials are exposed in those outbound requests, granting an attacker direct, full administrative access to the backend database. This risk is amplified in cloud deployments where CouchDB serves as the primary data store. No public exploit code or CISA KEV listing is identified at time of analysis.
Cross-application resource injection in Budibase Server before 3.41.3 allows any authenticated builder to plant tables, automations, queries, and screens into workspaces they have no authorized access to. The POST /api/resources/duplicate endpoint accepts an arbitrary destination workspace ID in the request body and performs no authorization check against the destination, enabling horizontal privilege escalation across workspace boundaries. Once malicious automations are injected, an attacker can trigger them to fire outbound webhooks relaying victim application data to attacker-controlled infrastructure, achieving data exfiltration. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.41.3.
Server-Side Request Forgery in Budibase Server self-hosted deployments exposes internal services on the RFC 6598 shared address space (100.64.0.0/10) by omitting that range from the default SSRF blacklist (DEFAULT_BLACKLIST) used for REST datasource query preview requests. Authenticated users holding the Builder role can submit a crafted POST /api/queries/preview request targeting a reachable host in 100.64.0.0/10, causing the Budibase server to proxy the request and return the internal service response through the preview flow, potentially exposing confidential internal data. No released patch has been identified; exploitation requires Builder-role access and a self-hosted deployment without a custom BLACKLIST_IPS override. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Budibase server before 3.41.3 allows an authenticated app-scoped builder to gain unauthorized builder access across all applications within the same tenant. By submitting crafted requests to the public user create or update API endpoints with manipulated builder.apps fields, the attacker bypasses the missing authorization check and self-assigns elevated builder privileges over unrelated applications. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the network-accessible, low-complexity nature of the attack makes this a significant risk in any multi-tenant Budibase deployment.
Authorization bypass in Budibase Server before 3.41.3 allows any authenticated user holding the lowest-privilege BASIC role to perform unrestricted read, create, update, and delete operations against any application table via the POST /api/datasources/query endpoint. Per-table role restrictions enforced elsewhere in the application are entirely absent on this API path, rendering the access control model trivially circumventable with a standard API call. No public exploit has been identified at time of analysis, though the low attack complexity - requiring only valid BASIC credentials and a crafted HTTP request - makes this a genuine priority for externally-accessible or multi-tenant deployments.
Authorization regression in Budibase v3.39.4 enables any authenticated BASIC user to generate S3 PutObject presigned URLs for arbitrary S3 buckets, bypassing the intended BUILDER-level permission gate on the attachment upload endpoint. The regression introduced in v3.39.4 - where the route guard was changed from `authorized(BUILDER)` to `authorized(PermissionType.TABLE, PermissionLevel.WRITE)` - gives all default BASIC users access to an endpoint that was explicitly restricted to builders. Compounding the issue, the endpoint accepts an attacker-controlled `bucket` parameter without validating it against the datasource's configured bucket, allowing writes to any S3 bucket reachable by the platform's stored IAM credentials. No public exploit tool exists at time of analysis, but the official GHSA advisory publishes complete reproduction steps and the test suite confirms the behavior, making exploitation trivial for any authenticated platform user.
NoSQL injection in Budibase Server's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) allows authenticated users with query write permission to bypass document-level filters and read, modify, or delete arbitrary MongoDB documents. The flaw stems from Handlebars interpolation being performed with escaping explicitly disabled (noEscaping: true), meaning JSON metacharacters in user-supplied parameters survive into the parsed query object that flows directly to MongoDB driver calls. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch commit and PR are publicly available on GitHub.
NoSQL injection in Budibase's MongoDB datasource integration (versions before 3.40.0) allows any authenticated BASIC user to bypass per-user query-level access controls by injecting MongoDB operators into query parameters. The root cause is Handlebars enrichment configured with `noEscaping: true` followed by `JSON.parse`, which promotes attacker-supplied `$`-prefixed operators directly into MongoDB query documents without filtering - enabling full collection dumps, server-side JavaScript execution via `$where`, and unauthorized update or delete operations. No public exploit has been identified at time of analysis, though upstream fix commits are available and the vulnerability targets a configuration pattern recommended in Budibase's own documentation.
Broken object-level authorization in the Hashtopolis server web-interface chunk activity component lets any authenticated low-privilege account read all cracked hashes across the entire server, regardless of access-group membership. Affecting all versions prior to 0.14.8, the flaw exposes recovered plaintext credentials - the core sensitive output of the platform - to users who should only see their own group's data. No public exploit is identified at time of analysis, but the vendor confirmed the issue and shipped a fix in v0.14.8.
Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor.
Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR.
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any other member's vault key and a victim-scoped access token. The POST /auth-requests/admin-request handler never verifies that the email in the request body belongs to the authenticated caller (CWE-639), so an attacker can create a Trusted Device Encryption admin-approval request for a victim, bound to an attacker-controlled public key; once approved, the encrypted key material is retrievable from an unauthenticated endpoint. Publicly available exploit code exists (a VulnCheck advisory plus a public write-up), and the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact plus a cross-user scope change.
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust availability of the platform, per vendor advisory TAN-2026-016. The flaw is network-reachable with low complexity and no privileges or user interaction (CVSS 7.5, availability-only impact), and the CWE-789 classification indicates an uncontrolled/excessive memory allocation can be triggered remotely. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a Custom role with the ManageUsers permission delete Admin accounts from the organization, undermining administrative control. The flaw stems from the bulk user-remove (DELETE) endpoint omitting the role-hierarchy guard that the single-user removal path enforces, so a lower-privileged user can strip Admins by submitting their organization-user IDs in a batch request. Publicly available exploit code exists (VulnCheck/researcher write-up), it is not listed in CISA KEV, and no EPSS score was provided in the input.
OS command injection in MariaDB Server (CWE-78) lets an attacker achieve remote code execution on Galera cluster nodes by embedding shell metacharacters in a joiner node's name, which the server passes unsanitized to the script defined in wsrep_notify_cmd. Affected branches are 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1, but only when wsrep_notify_cmd is configured. It carries a vendor CVSS of 9.8; however EPSS is very low (0.05%, 15th percentile) and SSVC marks exploitation as 'none', so there is no public exploit identified at time of analysis and it is not on CISA KEV.
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust resources and render the endpoint-management console unavailable, disrupting security operations across managed fleets. Rooted in a missing resource release (CWE-772), the flaw carries a 7.5 CVSS driven purely by availability impact, with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and EPSS probability is negligible at 0.03%. A vendor patch is available across the 7.6, 7.7, and 7.8 branches.
Credential disclosure in Devolutions Server (2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) lets a low-privileged authenticated user coerce the server's Active Directory browsing feature into authenticating against an attacker-controlled host, relaying the stored PAM provider service-account credentials. Classified as SSRF (CWE-918), it enables theft of privileged service-account authentication material that can then be abused against downstream systems. No public exploit identified at time of analysis; EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none.
Authentication bypass in Devolutions Server 2026.1.6.0 through 2026.1.16.0 lets an attacker who already knows a victim's password defeat that user's multi-factor authentication after the victim reconfigures their MFA factors, because factor key state is not properly reset. This is an authenticated (PR:L), user-interaction-dependent flaw (the victim must reconfigure factors) with total technical impact (full account takeover). It is not on CISA KEV and no public exploit identified at time of analysis; EPSS is very low at 0.05% (15th percentile).
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management privileges to retrieve or rotate organization SCIM API keys without master password re-authentication. An attacker with valid session credentials and SCIM management rights can obtain sensitive API keys that enable user provisioning control, potentially leading to unauthorized account creation, modification, or deletion within the organization. Public exploit code exists, and vendor patch v2026.4.1 addresses the issue via GitHub PR #7403.
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access, achieving complete administrative takeover. The vulnerability exploits a missing authorization check in the POST /providers/{providerId}/clients/existing endpoint, allowing authenticated provider users to add any organization to their provider without the target's consent. Publicly available exploit code exists (detailed writeup by Sanjok Karki), and vendor-released patch v2026.4.0 fully addresses the issue via GitHub PR #7372. Self-hosted installations are unaffected due to endpoint access restrictions. CVSS 8.9 reflects high confidentiality, integrity, and availability impact with high attack complexity and high privilege requirements.
Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time.
Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis.
Authenticated users can trigger a heap overflow in MariaDB 11.4 (before 11.4.10) and 11.8 (before 11.8.6) through the JSON_SCHEMA_VALID() function, causing denial of service and potentially remote code execution under specific memory layout conditions. The vulnerability requires valid database credentials and affects server availability and integrity across scope boundaries. No patch is currently available for vulnerable versions.
Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management.
An out-of-bounds memory read in MariaDB Server's spatial (GIS) functions lets an authenticated but low-privileged database user pass a truncated WKB MultiPolygon or MultiLineString to ST_Area, ST_Centroid, or GLength and have the parser read past the end of the allocated buffer, returning adjacent heap bytes as a geometry result or error path. Affected releases are MariaDB 10.6.1 through the fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires valid credentials and the ability to submit attacker-controlled spatial data (CVSS 4.3, PR:L), and the leak is primarily useful as an ASLR-bypass primitive inside a larger exploit chain rather than as a standalone compromise. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it should be treated as low-to-moderate priority and scheduled with routine patching; the vendor advisory GHSA-p7v9-24h4-mch8 and MDEV-40328 document the issue.
Missing FILE-privilege and secure_file_priv enforcement in MariaDB Server's optional CONNECT storage engine plugin lets an authenticated, low-privileged database user read or write files on the database host through the file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(), bypassing the access controls those functions were supposed to honor. Affected releases range from 10.6.1 up to (but excluding) the fixed builds 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires the CONNECT plugin to be installed and loaded (it is not part of a default MariaDB installation) plus a valid low-privileged account able to call the affected UDFs. The practical impact is bounded by the operating-system permissions of the database service account, so reachable files are limited to those the mysqld user can already read or write; no public exploit code has been identified at time of analysis, and the flaw is rated moderate (CVSS 3.1 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than an emergency.
Server-side request forgery in the PingOne groups endpoint of Devolutions Server 2026.3.8.0 and earlier lets an authenticated user with low privileges supply an attacker-controlled PingOne configuration in a request parameter and cause the server to act on it, resulting in exfiltration of the stored PingOne application secret. The issue carries a CVSS base score of 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), is limited to a confidentiality impact on the PingOne secret, and only affects instances where the PingOne integration is configured with a stored application secret. No public exploit code has been identified at time of analysis, and a vendor patch is available.
Authenticated PAM checkout users on Devolutions Server 2026.3.8.0 and earlier can manipulate the just-in-time (JIT) elevation settings embedded in a checkout update request to delete arbitrary Active Directory groups or preserve elevated privileges that should have been dropped at checkout. The flaw is a server-side trust issue: the application accepts client-supplied JIT elevation parameters without re-validating them, so an attacker only needs a provisioned account that already holds PAM checkout access. There is no public exploit identified at time of analysis, exploitation is not listed in CISA KEV, and the vendor has released a patched version; CVSS scores are modest (4.3 vendor base; independent assessment 4.3 with Scope:Changed, reflecting limited integrity and availability impact rather than confidentiality loss).
Incorrect authorization in Devolutions Server 2026.3.8.0 and earlier lets an authenticated user who holds only View permission on a connection retrieve stored add-on passwords, because the connection data returned to the client includes add-on properties unredacted rather than masked. Exploitation requires a pre-existing low-privilege account and only exposes secrets for connections that account can already view, so the impact is high-confidentiality but scoped to credentials stored in add-on properties; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor has released a fix, making this a genuine but moderate-priority information-disclosure issue rather than a critical emergency.
Improper access control in Devolutions Server 2026.3.8.0 and earlier lets an authenticated remote user who has only the general Edit permission - but who was explicitly not granted the Edit asset permission - change an asset's stored contact password by issuing a crafted request straight to the partial-save endpoint, skipping the UI-level authorization check (CWE-863). The consequence is confined to partial integrity loss (CVSS 4.3, AV:N/AC:L/PR:L/UI:N, C:N/I:L/A:N): no data disclosure or availability impact, and the attacker must already hold a valid account with Edit rights, so this is not a privilege-escalation path to full administrative control. No KEV listing, no active exploitation and no public exploit code were identified at time of analysis, and SSVC/EPSS-style signals (Exploitation: none, Automatable: no, Technical Impact: partial) place this at low real-world priority; the flaw is fixed in 2026.3.10.
Account takeover in Gotify server versions prior to 3.0.0 allows an authenticated attacker who possesses a valid client token to change the associated user's password without providing the current password or an elevated authentication step. This CWE-620 (Unverified Password Change) flaw gives the attacker control of password authentication for the account, potentially locking out the legitimate user and forcing recovery through an administrator or direct database access. The vulnerability is fixed in version 3.0.0, and no public exploit code or active exploitation has been identified at time of analysis.
Privilege confusion in MariaDB Server (10.6.1 through the 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.x and 13.0.x lines prior to the fixed releases) allows an authenticated attacker who already holds the CREATE USER privilege to create a principal whose name collides with an existing role or localhost user in the database-privilege ACL cache, then exercise database privileges belonging to that other account. Because roles and localhost users were both cached with an empty IP component, the cache key could resolve to the wrong principal once the legitimate account's database privileges had already been cached through normal use, matching the assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (high confidentiality and integrity impact, no availability impact). Exploitation is not reachable by unauthenticated or low-privilege users and depends on non-trivial account-naming collisions plus ACL-cache timing state, so the practical risk is concentrated in privileged insiders or already-compromised administrative accounts. Vendor-released fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; no public exploit identified at time of analysis.
Out-of-bounds reads in MariaDB Server's legacy mysql_json plugin can expose memory contents or crash the server when the plugin parses a specially crafted MySQL-origin table containing invalid MySQL binary JSON. The flaw affects MariaDB 10.6.1 and later branches up to (but excluding) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is only reachable when tables imported from MySQL must be read through the mysql_json compatibility path - for example during ALTER TABLE ... FORCE. The CVSS vector (AV:L, PR:N, UI:R, S:U, C:L, I:N, A:L, score 4.4) confirms this is a local, interaction-driven issue rather than a remotely exploitable one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available.
Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.
Account takeover is possible in Devolutions Server 2026.3.7.0 and earlier through an authentication bypass in the OAuth device authorization (device code) flow, in which a captured device verification link can be replayed to bind an attacker-controlled client to a victim's account. The flaw is rated 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N): the attacker needs no credentials, but must first obtain a valid, still-replayable verification link and then rely on an already-authenticated victim interacting with it, which keeps attack complexity high and exploitation dependent on user behavior. Exploitation has not been observed (CISA SSVC reports Exploitation: none, Automatable: no) and no public exploit identified at time of analysis; Devolutions has released a fix in Server 2026.3.8.
Account takeover in Devolutions Server 2026.3.7.0 and earlier is possible through the Azure AD external login flow: an attacker positioned on an adjacent network segment (AV:A) can capture a login-session token that is exposed in the OAuth redirect URL and replay it to hijack the victim's account. Exploitation is limited to deployments where Azure AD external login is actually configured, and it requires intercepting a live, still-valid token during a genuine user login (AC:H), though no victim interaction with the attacker is needed (UI:N, PR:N). Independent signals are currently low - no public exploit identified at time of analysis, not listed in CISA KEV, EPSS 0.22% (11th percentile), and CISA SSVC records Exploitation: none and Automatable: no - but the vendor has released a patch and SSVC rates technical impact as total, so this is a genuine, moderate-priority issue rather than a top-tier emergency.
Missing authorization in the attachment history API of Devolutions Server 2026.3.5.0 and earlier lets an authenticated low-privileged user permanently delete or restore vault attachments by sending a crafted API request. The flaw requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base score 5.4) and is limited to integrity and availability of attachment data - there is no confidentiality exposure and no code execution. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor patch is available in Devolutions Server 2026.3.7.0.
Devolutions Server versions up to 2026.3.5.0 contain a missing authorization flaw in the data source settings API that lets an authenticated, non-administrative user craft a request to disclose stored integration secrets. The vulnerability requires low-privileged credentials (PR:L) and network access, yielding high confidentiality impact with no integrity or availability effect (CVSS 6.5). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a patched version 2026.3.7.0.
Improper access control in the partial connection API of Devolutions Server (reported as 2026.3.5.0 and earlier; EUVD tracks all builds prior to 2026.3.7.0) lets an authenticated low-privileged user read, create, modify, and delete System Vault entries through a crafted API request. Exploitation requires valid credentials on the instance plus network reachability to the endpoint, with no user interaction and no non-default configuration needed; the notable concern is integrity of the stored privileged secrets, reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L and an overall MEDIUM rating rather than a high-severity emergency. No public exploit code has been identified and SSVC records Exploitation: none, so there is no evidence of active exploitation at time of analysis; a vendor fix is available in 2026.3.7.0.
Devolutions Server versions prior to 2026.3.7.0 contain an improper rule enforcement flaw in the PAM Active Directory provider that allows an authenticated user with PAM edit permissions to bypass Devolutions Gateway host rulesets, potentially exposing restricted hosts to unauthorized access. This low-severity (CVSS 4.3) authorization-scoping weakness requires specific configuration-the PAM AD provider and a Gateway host ruleset-and no public exploit or active exploitation has been identified at time of analysis. The primary impact is a limited confidentiality breach.
Unauthenticated server-side request forgery in Budibase's Microsoft Teams webhook endpoint (all Budibase Server releases before 3.45.0) lets remote attackers submit a forged Bot Framework activity containing an arbitrary serviceUrl that the server persists and then reuses for every subsequent outbound bot reply. Those replies carry live Microsoft OAuth access tokens in their Authorization headers, so the server ultimately transmits credentials to the attacker's host and can also be steered into blind requests against internal network resources. The flaw is network-reachable and needs no authentication or user interaction (CVSS 4.0 PR:N/UI:N/AV:N), but exploitation is tempered by high attack complexity (AC:H) because a structurally valid activity payload is required and the attacker must win the persistence-then-reply flow; the endpoint is only exposed where the Microsoft Teams bot integration is configured and reachable, and no public exploit has been identified at time of analysis.
Sync-in Server versions prior to 2.4.1 leak account existence through a timing side channel in the login endpoint, allowing unauthenticated remote attackers to enumerate valid usernames or email addresses. The issue arises because login attempts for nonexistent accounts return early without running the bcrypt comparison performed for real accounts, producing a measurable difference in response times. This is a low-severity information-disclosure weakness (CVSS 5.3) that reveals only whether an account is registered, but can be chained into credential-stuffing, password-spraying, or phishing attacks; no public exploit identified at time of analysis.
An authenticated user of Sync-in Server (any version prior to 2.4.0) can render the entire instance unresponsive indefinitely by submitting a catastrophic-backtracking regular expression to the sync diff endpoint, which compiles the user-supplied string into a RegExp without complexity validation. Because Node.js runs JavaScript on a single shared event loop, a pattern such as '^(a+)+b' stalls processing for all connected users, and the service remains frozen until the container is manually restarted - an availability-only impact rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Version 2.4.0 fixes the issue; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Sync-in Server versions prior to 2.4.0 fail to increment the failed-attempt counter when a valid username and password are paired with an incorrect TOTP code on the desktop sync registration endpoint (POST /api/app/sync/register), so the account lockout threshold of 10 is never reached. An attacker who already possesses working first-factor credentials-and is targeting an account with 2FA enabled-can repeatedly guess the rotating 6-digit TOTP without triggering lockout; a successful guess yields a client ID and token that can be exchanged for a full JWT, after which the attacker can call POST /api/auth/2fa/disable to permanently remove MFA. Exploitation requires authenticated access (PR:L) and the high attack complexity (AC:H) reflects the need to guess a time-based code within its short validity window; no public exploit identified at time of analysis. This is a real, credible authentication-security issue but not a mass-exploitation emergency.
File owners on Nextcloud Server cannot release TYPE_TOKEN file locks that other users have placed on their files, leaving the file locked with no in-product recovery path; administrators currently have to clear the orphaned lock directly in the database. The defect is an access-control gap (CWE-284) reachable over the network by any authenticated user who can acquire a token lock, typically in shared-folder or multi-user collaboration scenarios, and it is availability-only - no confidentiality or integrity impact - as reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. No public exploit code has been identified and there is no evidence of active exploitation, so despite a 6.5 base score this behaves as an accidental or malicious file-lockout rather than a scalable remote attack.
Authorization bypass in Nextcloud Server (Circles feature) lets an authenticated user retrieve the membership list of a circle they do not belong to, exposing membership information for Nextcloud Server 32.0.0 through 34.0.0, as detailed in HackerOne report 3484601. Exploitation is gated by a severe practical constraint: the attacker must supply an existing circle's unique identifier, which lives in a 62^15-space (roughly 90-bit) keyspace, so the CVSS 3.1 score reflects high attack complexity rather than an easily reachable bypass and no public exploit has been identified at time of analysis. Impact is limited to confidentiality of one circle's member list; no modification, deletion, or service disruption is possible, making this a low-priority issue for most deployments.
Metadata disclosure in Nextcloud Server's Photos app smart albums allows an authenticated user to enumerate file names, IDs, and other metadata from a sharer's folders that were never intended to be included in the shared album. This moderate, tightly scoped authorization flaw (CWE-284) occurs because the smart album builds its file listing using the viewing user's photosSourceFolders search configuration instead of the album owner's configuration; an attacker who has been granted a filter-based smart album share can modify their own folder settings to widen the search scope. No public exploit code is identified at time of analysis, and the independent assessment limits impact to metadata (not file content) within the filter-reachable scope; it cannot reach files of users who have not shared such an album.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may inject forged, arbitrarily backdated event entries into organizations they have no membership in by sending crafted POST /collect API requests. All self-hosted Bitwarden Server instances prior to version 2026.7.2 are affected. A publicly available proof-of-concept exploit exists per researcher Sanjok Karki's blog post; no active exploitation has been confirmed in CISA KEV, but the low exploitation barrier and available PoC make patching urgent for compliance-sensitive deployments.
Improper authorization in Devolutions Server's secure messages deletion endpoint exposes an Insecure Direct Object Reference (IDOR) flaw allowing any authenticated user to permanently delete secure messages belonging to other users simply by supplying a target message identifier. Affected versions are 2026.2.11 and 2026.1.22; patched releases 2026.1.23 and 2026.2.12 are available per the vendor advisory. No public exploit identified at time of analysis, and the low CVSS score of 3.1 reflects constrained impact (integrity only, no data disclosure) paired with high attack complexity.
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
JSON injection in Bitwarden Server's IntegrationTemplateProcessor.ReplaceTokens() allows authenticated organization members to corrupt event-integration payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints. Any organization running Bitwarden Server prior to 2026.5.0 that has configured event integrations referencing user-controlled tokens such as #ActingUserName# or #UserName# is exposed. A public proof-of-concept exists per VulnCheck and independent researcher disclosure; exploitation is constrained by authentication and specific integration-configuration prerequisites, reflected in the low CVSS 4.0 score of 2.3.
Broken access control in Bitwarden Server before 2026.5.0 exposes organization billing data to any authenticated user via an IDOR vulnerability in the PreviewInvoiceController endpoints. The missing ManageOrganizationBillingRequirement authorization check permits a valid session holder to supply an arbitrary organizationId and retrieve Stripe-derived billing details - including tax totals, subscription status, and customer data - for organizations they do not belong to. A public proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at the time of analysis.
NTLM credential coercion in Devolutions Server 2026.2.4.0 through 2026.2.6.x allows an authenticated user with the UserGroupsView permission to redirect PAM Active Directory discovery requests to an attacker-controlled host, capturing PAM provider service account credentials as NTLMv2 challenge-response hashes. The vulnerability exists within the PAM AD discovery endpoints and is triggered by supplying a crafted DomainName parameter that causes the server to initiate an outbound NTLM authentication handshake. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS is 0.22% (12th percentile), indicating very low current exploitation probability.
Command injection (CWE-78) in Devolutions Server's built-in PAM provider password rotation templates allows an attacker with vault write access to execute arbitrary OS commands on systems managed by the affected PAM provider. Affected versions include 2026.2.4.0 and all releases at or below 2026.1.20.0, reported directly by the vendor Devolutions. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the high-value nature of a PAM platform managing privileged credentials on downstream systems means the practical blast radius substantially exceeds what the CVSS C:L/I:L scores suggest.
Missing authorization on the deleted user groups API in Devolutions Server enables authenticated low-privileged users to enumerate metadata of deleted user groups via crafted API requests, bypassing intended access controls. Affected deployments include versions 2026.2.4.0 and 2026.1.20.0 and earlier, as confirmed by the vendor advisory DEVO-2026-0015. No public exploit exists and CISA SSVC confirms no active exploitation, placing this at low operational priority despite its network-accessible attack vector.
Cleartext credential exposure in Devolutions Server allows an authenticated low-privileged user to retrieve plaintext credentials stored for configured ticketing integrations via a crafted API request. Affected versions include Devolutions Server 2026.2.4.0 and all 2026.1.x releases up to and including 2026.1.20.0. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-disclosed by Devolutions via advisory DEVO-2026-0015.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated low-privilege user to delete PAM network discovery scan configurations that should be restricted to administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only a valid low-privilege account over the network with no user interaction. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated user holding entry edit privileges to modify asset information beyond their authorized scope, bypassing the permission validation layer. The flaw resides in the permission validation component and enables privilege overreach within the platform's access control model - an authenticated low-privilege user can alter data they should have no write access to. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in Devolutions Server's entry status management feature allows authenticated non-administrator users to circumvent an administrator-enforced Pending Approval workflow, gaining unauthorized access to protected entry data through a crafted status change request. Affected versions span the entire 2025.3.x line through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 to 2026.1.16.0, as confirmed by Devolutions advisory DEVO-2026-0013. No public exploit has been identified and EPSS sits at 0.03% (7th percentile), indicating negligible observed exploitation activity; SSVC corroborates no known exploitation at time of analysis.
Devolutions Server's entry activity log feature fails to enforce per-permission authorization on its API layer, allowing authenticated users to retrieve audit trails for vault entries they can access but are explicitly denied log-viewing rights on. Affected are all Devolutions Server releases through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 through 2026.1.16.0. No public exploit code exists and EPSS sits at 0.03% (7th percentile), placing real-world exploitation risk firmly in the low tier despite the network-reachable attack vector.
Sealed-entry audit bypass in Devolutions Server allows an authenticated high-privileged user to silently retrieve sensitive data from protected vault entries without generating the expected unseal audit notification, undermining privileged access oversight controls. Affected versions span all releases through 2025.3.20.0 and the 2026.1.6.0 to 2026.1.16.0 range. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the compliance and insider-threat implications are significant in PAM environments where sealed-entry audit trails are the primary detection mechanism for sensitive credential access.
Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.
Missing authorization on the profile update API in Devolutions Server allows any authenticated Active Directory user to modify their own profile attributes beyond their permitted scope via a crafted API request. Affected are versions 2025.3.20.0 and earlier and 2026.1.6.0 through 2026.1.16.0. No public exploit has been identified and EPSS sits at 0.03% (8th percentile), but any AD-authenticated user with network reach to the API can tamper with profile data without additional privilege.