Authentication Bypass

Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.

Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.

Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.

Product Slider for WooCommerce plugin (versions ≤1.13.62) exposes an Insecure Direct Object Reference flaw that allows authenticated contributors to access WooCommerce objects beyond their authorization scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-reachable exploitation requiring only a low-privilege contributor account, resulting in limited confidentiality disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, placing this in the 'monitor and patch' category rather than emergency response.

Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.

Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.

Broken access control in ShopLentor Pro (WordPress WooCommerce page builder plugin) versions up to and including 2.8.5 allows authenticated subscriber-level users to perform privileged actions beyond their intended authorization scope, resulting in unauthorized data or configuration modification. The flaw is network-accessible with low attack complexity and requires only a low-privilege WordPress account. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog.

Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.

Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view. The CVSS vector confirms PR:L - a valid authenticated session at the subscriber tier is sufficient - and C:H indicates the exposed data carries high confidentiality value, consistent with ERP payloads such as HR records, financial data, and customer information. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862). The plugin fails to enforce capability verification before processing deletion requests, meaning any user holding the lowest standard WordPress role can permanently destroy posts, pages, or other content objects outside their normal permissions. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this straightforward to abuse on any site where user registration is open.

Unauthenticated broken access control in the Knit Pay WordPress payment plugin (versions <= 9.6.0.0) allows remote, unauthenticated attackers to perform unauthorized actions resulting in limited integrity and availability impact against affected WordPress installations. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants prompt remediation on any publicly accessible WordPress deployment running this plugin.

Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authenticated users to perform actions or access resources beyond their intended permissions. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper authorization checks on certain endpoints accessible to low-privileged accounts. With partial confidentiality, integrity, and availability impact confirmed by the CVSS C:L/I:L/A:L metrics, affected photography business sites with open subscriber registration face meaningful risk of data exposure or unauthorized functional access. No public exploit has been identified at time of analysis.

Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.

Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.

Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.

Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.

Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.

Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.

Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling network-accessible exploitation with no credentials required. Impact is limited to a partial confidentiality breach - no data modification or availability impact - but the zero-barrier entry point makes it trivially reachable by automated scanners. No public exploit code or CISA KEV listing has been identified at time of analysis.

Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Authentication bypass in the Premium Packages - Sell Digital Products Securely WordPress plugin (wpdm-premium-packages) through version 7.0.4 allows remote unauthenticated attackers to obtain valid WordPress session cookies for any non-administrator user who owns an order. The root flaw is the `download()` function accepting an attacker-controlled `wpdmppdl` parameter decoded with only base64 and JSON - no HMAC, nonce, or cryptographic signature - and then issuing authentication cookies after a domain check that is entirely attacker-supplied on both sides, making it trivially bypassed. No public exploit has been identified at time of analysis and the vulnerability is not confirmed as actively exploited in CISA KEV.

GeoIP rule bypass in Joomla Geo

GutenKit Blocks for WordPress exposes a site's stored Mailchimp API key and full audience configuration to any unauthenticated HTTP caller via two REST API endpoints registered without authorization checks in versions up to and including 2.4.12. Both /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests use permission_callback => '__return_true', stripping all access control and returning Mailchimp audience IDs, merge fields, interest categories, and subscriber counts alongside the raw API key. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but exploitation requires only a single unauthenticated HTTP GET request, making mass automated scanning trivially feasible on any site with the Mailchimp integration configured.

DNSSEC validation is bypassed in PowerDNS Recursor when wildcard-synthesized answers are CNAME or DNAME record types, allowing an attacker positioned to inject forged DNS responses to circumvent cryptographic integrity guarantees. Wildcard expansion proofs - the NSEC or NSEC3 records that DNSSEC uses to prove a wildcard match is legitimate - are accepted by the recursor without verifying their signatures in this specific code path. No public exploit code has been identified at time of analysis, and EPSS data was not provided; however, the bypass of DNSSEC undermines a core trust mechanism used by resolvers to reject forged DNS data.

Missing authorization in the seunshare utility (policycoreutils through 3.10) permits a low-privileged local user running in an unconfined SELinux domain to send kill signals to root-owned processes also running in unconfined context - effectively enabling unprivileged denial-of-service against privileged system processes. The root cause (CWE-862) is the absence of ownership validation before allowing signal delivery, bypassing the expectation that non-root users cannot terminate root-owned processes. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.

Header injection in Netty's StompSubframeEncoder allows low-privileged network attackers to embed arbitrary STOMP headers into CONNECT and CONNECTED frames by supplying newline characters in header values. Affecting netty-codec-stomp prior to 4.1.136.Final and 4.2.x before 4.2.16.Final, the encoder deliberately skips the escape() function for CONNECT frames per STOMP 1.2 backward-compatibility requirements but neglects to reject raw newline characters, conflating 'no escaping' with 'no validation.' A fully functional proof-of-concept is publicly available and confirmed against Netty 4.2.12.Final; no public exploitation in the wild (CISA KEV) has been confirmed at time of analysis.

Information disclosure in Regular Labs Joomla extensions (Users Anywhere and Articles Anywhere) allows authenticated users to access insufficiently restricted user fields via crafted content containing user tags, filters, or conditions. Attackers with low privileges can expose authentication-related data, raw user parameters, and restricted contact details. No public exploit or active exploitation has been identified at the time of analysis, and the EPSS score (0.23%) indicates low exploitation probability.

MongoDB Server's bundled MozJS (SpiderMonkey) scripting engine unconditionally registers a module loading hook that permits JavaScript code - executing inside aggregation pipeline stages - to read arbitrary files from the host filesystem using the mongod process's OS-level privileges. Any authenticated database user with permission to run JavaScript-enabled aggregation stages can craft pipeline commands to exfiltrate sensitive host files such as private keys, configuration files, or application secrets, bypassing MongoDB's own role-based access controls. No public exploit code or CISA KEV listing exists at time of analysis, but low attack complexity and a default-enabled attack surface make this a meaningful threat in any deployment with untrusted or broadly-credentialed users.

MongoDB's cursor termination authorization logic fails to scope privileges to the correct database namespace, allowing an authenticated low-privilege user to terminate active cursors on databases they do not administer. Exploitation requires the attacker to hold cursor termination rights on at least one database, limiting the practical threat to malicious or compromised internal users. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Incorrect authorization in MongoDB's $listSessions aggregation stage allows any authenticated user to enumerate session metadata cluster-wide - a capability that should be restricted to cluster-level administrators. Exposed data includes active session identifiers, associated usernames, and activity timestamps, which in combination represent a meaningful secondary risk for session-hijacking attempts against high-value accounts. No public exploit code exists and this is not listed in CISA KEV at time of analysis; however, the low exploitation bar (any valid MongoDB account) in multi-tenant environments elevates real-world concern above the moderate CVSS score alone.

Atlas Search integration in MongoDB's sharded topology exposes a per-user access control bypass to authenticated low-privileged users. The `$search` and `$searchMeta` aggregation pipeline stages rely on internal routing fields that are intended to be injected exclusively by the trusted mongos router during sharded query planning; due to insufficient input validation (CWE-20), an authenticated client can supply these fields directly and circumvent the access controls normally enforced per-user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects the combination of high confidentiality impact against a sharded-only attack surface requiring authenticated access.

Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch and published an advisory.

Missing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD - to abuse by a privileged local attacker operating in subsystem mode. By supplying mailbox commands containing unverified AXI bus addresses, an attacker can crash the Caliptra Root of Trust firmware, causing a denial of service against the hardware security enclave. The vendor notes that security impact beyond availability is integration-specific, meaning depending on how the SoC integrates Caliptra, subsequent-system integrity (SI:L per CVSS 4.0) may also be affected. No public exploit is identified at time of analysis.

Unauthenticated directory enumeration in InvokeAI before 6.13.7 exposes arbitrary server filesystem paths via the GET /api/v2/models/scan_folder endpoint, which accepts attacker-controlled scan_path parameters without requiring authentication. Beyond path traversal and file existence probing, the vendor's own release notes confirm a closely related attack path capable of recovering full contents of invokeai.yaml and api_keys.yaml - files that may contain API tokens for HuggingFace, Civitai, Alibaba, and OpenAI services. A publicly available exploit exists (GitHub issue #9365); no active exploitation is confirmed in CISA KEV.

Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global `eventdefinitions:create` capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.

PKCE bypass in librest allows OAuth 2.0 client impersonation by exploiting a cryptographically weak pseudo-random number generator. The library's code verifier generation for PKCE (RFC 7636) uses GLib's GRand function - a non-cryptographic PRNG with a 32-bit seed space - rather than a CSPRNG, enabling a positioned attacker to recover the PRNG seed and reconstruct the code verifier to hijack the token exchange. Rated CVSS 6.8 with high confidentiality and integrity impact; no public exploit or CISA KEV listing identified at time of analysis.

Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. Clients mapped to that view subsequently receive answers from the public internet for names that are supposed to be handled locally, silently subverting operator-defined DNS policy. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

DNS Cookie bypass in NLnet Labs Unbound 1.18.0 through 1.25.1 allows an off-path network attacker to defeat RFC 7873 DNS Cookie spoofing protections when Unbound is simultaneously configured with proxy-protocol-port and answer-cookie: yes. The RFC 9018 server-cookie SipHash is computed over the proxy node's wire-layer IP address rather than the PROXYv2-declared client address, meaning a single valid cookie harvested through any proxy node is reusable against every spoofed source behind that node. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the conceptual attack path is straightforward for any attacker with the ability to send one legitimate DNS query through the affected proxy infrastructure.

Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

DNS stub and forward zone resolution in NLnet Labs Unbound 1.13.2 through 1.25.1 is silently bypassed due to an off-by-one error in the default-enabled `harden-below-nxdomain` feature. When a configured stub or forward zone apex is nested two or more labels beneath a DNSSEC-signed public zone and the resolver cache holds a DNSSEC-secure NXDOMAIN for the intermediate label, the guard logic walks one label too far, causing the stub/forward upstream to be permanently shadowed without error. No public exploit has been identified at time of analysis and CVSS 3.7 with AC:H reflects the narrow but realistic conditions common in enterprise private namespace deployments.

Resolution service degradation in NLnet Labs Unbound 1.22.0 through 1.25.1 enables unauthenticated remote attackers to silently drop DNS responses for new clients by exploiting a resource-accounting flaw in the DNS-over-QUIC (DoQ) subsystem. Attackers send DoQ queries for names that trigger upstream resolution and immediately terminate them using QUIC STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames, causing Unbound's internal wait-reply counter to inflate indefinitely without release. When the counter ceiling is reached, new clients querying the same in-flight names receive no response. No public exploit has been identified at time of analysis; exploitation is constrained by non-default DoQ configuration requirements and the need for multiple source IPs.

Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privileged Kubernetes user to reference file-provider TCPServersTransport configurations across namespace boundaries that the crossProviderNamespaces allowlist should block. The allowlist was enforced for HTTP serversTransport references but silently omitted from the equivalent TCP code path, creating an inconsistent and exploitable access boundary. By crafting an IngressRouteTCP resource with serversTransport: foo@file, an attacker causes Traefik to apply privileged backend settings - including mTLS client certificates, SPIFFE workload identities, or PROXY-protocol configuration - belonging to namespaces they are not authorized to access. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in 3.6.23 and 3.7.7.

Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route author to attach unauthorized Traefik Middleware objects from foreign namespaces by exploiting incorrect namespace resolution in HTTPRoute extensionRef handling. An attacker holding an existing ReferenceGrant for a cross-namespace Service can leverage the flaw to inject trusted reverse-proxy identity headers into downstream requests - without a separate ReferenceGrant authorizing the Middleware - potentially bypassing authorization controls in backend services that trust those headers. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released fix is version 3.7.7.

Credential exfiltration in n8n's GraphQL node allows authenticated non-owner users to bypass the platform's 'Allowed HTTP Request Domains' domain-restriction policy and route HTTP-based credentials to an attacker-controlled server. Unlike the HTTP Request node, which correctly enforces domain allowlists, the GraphQL node omits this authorization check entirely, meaning any low-privileged workflow editor can redirect HTTP-based credential types - Header Auth, Basic Auth, Query Auth, and OAuth - to an arbitrary endpoint. No public exploit code or active exploitation has been identified at time of analysis; impact is bounded to deployments using domain-restricted shared credentials.

Broken authorization in n8n's OAuth 2.1 consent flow allows a member-level authenticated user to self-approve OAuth consent for workflows they do not own, then execute those workflows in the victim owner's project context using the owner's stored credentials. Versions 2.27.0 through 2.29.7 and 2.30.0 are affected - the flaw was introduced precisely when the OAuth 2.1 MCP Server Trigger flow was added. On multi-user instances with at least one OAuth2-enabled MCP Server Trigger workflow, the attacker obtains a valid token, drives the workflow with attacker-controlled inputs, and reads outputs that may include sensitive data exfiltrated from the owner's connected third-party integrations, breaking both user and project isolation. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.

Unauthenticated cancellation of active test webhook sessions is possible in n8n prior to 2.28.0 (and prior to 2.27.4 on the 2.27.x branch) because the DELETE test-webhook endpoint is registered before the authentication middleware stack, making it reachable by any network caller who possesses a valid workflow ID. The impact is deliberately scoped: only in-progress developer test sessions can be disrupted; production webhooks, persistent workflow state, and stored data are explicitly unaffected per the vendor advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 AT:P qualifier confirms a workflow-ID prerequisite limits opportunistic mass exploitation.

Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user, regardless of organizational access controls. Three event group types - inventory_update_events, project_update_events, and system_job_events - are absent from the consumer_access() authorization mapping, causing authorization checks to be silently skipped when users subscribe to these channels for arbitrary object IDs. This is confirmed as an incomplete remediation of CVE-2020-10698, affecting Red Hat Ansible Automation Platform 2. No public exploit or CISA KEV listing is identified at time of analysis.

Authorization bypass in Universe Software's Online Registration and Workflow Management System (through version 12022026) allows authenticated low-privilege users to access other users' registration records by manipulating user-controlled key parameters. The vulnerability, classified as CWE-639 (IDOR), exposes a high-severity confidentiality impact with no integrity or availability risk - attackers can read but not modify data. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any authenticated user of the platform.

Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.

Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Mark-of-the-Web bypass in BandiZip 7.37 allows remote attackers to craft archives that, when extracted, fail to propagate zone identifiers to extracted files, letting malicious executables run without security warnings. A public proof-of-concept is available; the EPSS exploitation probability is low (0.39%).

Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Incorrect Authorization in Kibana's Machine Learning management endpoint allows a low-privileged authenticated user to manipulate ML audit and notification records for arbitrary jobs across any space or user boundary. The endpoint validates only a coarse ML access privilege without enforcing resource-level authorization, and then uses Kibana's internally elevated credentials to write to restricted ML system indices on behalf of the requesting user. No public exploit has been identified at time of analysis, and CVSS scores this at Medium (4.3) given the limited integrity-only impact scope.

Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.

Outbound request restriction bypass in Kibana's Reporting feature enables authenticated low-privileged attackers to cause the reporting service to issue HTTP requests to network destinations explicitly denied by administrator-configured security policy. Affected versions span Kibana 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Kibana itself to internal network resources, making this a server-side request forgery (SSRF)-class issue. No public exploit code or CISA KEV listing identified at time of analysis.

Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.

Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.

Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.

Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.

Unauthorized data access and partial denial of service in Oracle Advanced Benefits (E-Business Suite Self Service Benefits component) is achievable by low-privileged, network-authenticated attackers over HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected, spanning a broad range of Oracle EBS deployments. Oracle classifies this as 'easily exploitable' in the July 2026 CPU; no public exploit identified at time of analysis and not listed in CISA KEV, but the low attack complexity and no user interaction requirement elevate realistic risk for organizations with internal threat actors or compromised credentials.

Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.

Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.

Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.

Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.

Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.

Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.

Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.

Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.

Integrity compromise in Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes an authorization bypass in the Internal Operations component, allowing a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible contract data via HTTP. The tag 'Authentication Bypass' from the EUVD entry indicates the flaw permits a legitimately authenticated but restricted user to exceed their intended data-access boundaries within the application. No public exploit or CISA KEV listing exists at time of analysis, limiting immediate mass-exploitation risk, though the low attack complexity and no required user interaction make the vulnerability straightforwardly exploitable once an attacker holds any valid application credential.

Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.

Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.

Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.

Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.

Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.

Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.

Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthorized data access in Oracle Advanced Benefits 12.2.15 can be achieved by any low-privileged authenticated attacker over HTTP, targeting the Internal Operations component of Oracle E-Business Suite. The flaw - tagged as an Authentication Bypass - permits complete read access to all data accessible within the module, including data classified as critical. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and absence of required user interaction make it straightforward to exploit once credentials are obtained.

Oracle Price Protection (Internal Operations component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a medium-severity flaw allowing low-privileged, network-accessible attackers to partially compromise data confidentiality, integrity, and availability via HTTP. The vulnerability is easily exploitable with no attack complexity, requiring only a valid low-privileged account, enabling unauthorized read, write/delete operations on a subset of Price Protection data, and the ability to cause partial denial of service. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, network-adjacent attacker over HTTP, affecting all E-Business Suite deployments on versions 12.2.4 through 12.2.15. Successful exploitation yields unauthorized read access to a subset of benefits data, unauthorized write/insert/delete capability against accessible records, and the ability to cause partial denial of service within the affected component. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the low complexity and minimal privilege threshold make it accessible to a broad pool of internal threat actors.

Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.