Authentication Bypass

Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.

Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.

Lantronix XPress-DR and XPress-DR-I (CoBos-family) devices running firmware through 8.1.0.0 expose an unauthenticated UDP configuration service on port 30718 that lets any remote attacker who can reach that port read live configuration data with a type 0xF8 query and persistently rewrite the device IP address and serial-channel forwarding records using a type 0xFD frame with an exactly 0x78-byte body, with the changes committed to EEPROM and surviving reboots. The root cause is missing authentication for a critical function (CWE-306), and no credentials, user interaction, or non-default settings are required; the only practical barriers are network reachability of UDP/30718 and the shrinking installed base after the series reached end-of-life in February 2025. The CVE record scores this 9.3 under CVSS 4.0 and our independent assessment rates it 9.8 under CVSS 3.1; no public exploit code or confirmed active exploitation was identified at time of analysis, though the attack itself is trivial to perform against any reachable device.

Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.

Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.

Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.

Authentication bypass in Zulip Server through 12.1 can log an attacker into an existing user account when OIDC single sign-on is configured with a misconfigured identity provider. The GenericOpenIdConnectBackend matches the IdP's email claim against an active account's delivery_email without rejecting an explicit email_verified=false, so a user who does not control that address can be authenticated as the account that owns it. Exploitation requires OIDC SSO to be enabled, a trusted IdP that emits email addresses the authenticating user does not control, and a pre-existing account whose delivery_email matches that address; deployments whose IdP only emits user-controlled addresses are explicitly not affected. The vendor fixed the flaw in Zulip Server 12.2, unauthenticated remote exploitation is rated Critical (CVSS 4.0 9.1, AT:P), and no public exploit has been identified at time of analysis.

Account pre-hijacking in the Prowler API (5.4.0 up to but not including 5.35.0) lets an unauthenticated remote attacker gain persistent control of a user account that has not yet registered, by self-registering the victim's email address before the real owner ever signs up or links single sign-on. Because social account linking in ProwlerSocialAccountAdapter.pre_social_login() matches a Google or GitHub login to any existing local account with the same email address without requiring the address to be verified by the provider or on the local account, the genuine owner's later social sign-in is silently connected to the attacker's pre-created account, and the attacker's original password remains valid, exposing cloud provider credentials, scan findings and tenant memberships held in that account. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though exploitation requires only open self-registration plus a victim who later authenticates through Google or GitHub (a race condition that closes once the legitimate owner has an account). The source assigns CVSS 4.0 7.6 (HIGH); our independent assessment scores it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.

Authenticated users on Discourse sites running the bundled Chat plugin can receive live and recent private-category channel messages they are not entitled to see, because the MessageBus publication audience for a read-restricted category channel is bounded by category visibility alone and never verifies Chat eligibility under the site's group restrictions (CWE-862 missing authorization). Only sites where chat is enabled, a chat channel is attached to a read-restricted category, and chat_allowed_groups are configured such that a user may view the category while being excluded from Chat are affected; exploitation requires a valid authenticated account with category-view access, which the assessed vector reflects (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Disclosure is confined to messages flowing through the MessageBus stream and its short backlog - the Chat API does not expose full channel history, and no message creation or modification is possible - making this a moderate confidentiality-only issue with no public exploit identified at time of analysis.

Incorrect authorization in the Client Certificates module of Progress MOVEit Transfer lets an attacker who already holds a valid low-privilege account escalate to full control of managed file-transfer data and configuration (CVSS 8.8, PR:L/AV:N). Affected builds are all releases before 2025.1.6 and 2026.0.0 through 2026.0.3, and the Client Certificates feature must be in active use for the flawed authorization path to be reachable. There is no public exploit code identified at time of analysis and EPSS sits at roughly 0.21% (11th percentile), so risk is real but not urgent; a vendor patch is available per the Progress September 2026 security bulletin.

Dell Terraform Provider for Redfish versions before 1.6.2 exposes Redfish BMC traffic, including credentials, to man-in-the-middle interception because TLS certificate verification is unconditionally disabled in its base HTTP transport. This critical-severity flaw (CVSS 9.0) allows an unauthenticated remote attacker who occupies a MITM position to capture or alter sensitive Redfish API communications, though exploitation is condition-gated to active provider-to-BMC traffic windows and is materially lower risk on trusted, isolated management segments. No public exploit identified at time of analysis; Dell recommends upgrading to 1.6.2.

Authentication bypass via capture-replay in Progress MOVEit Transfer's OIDC module allows a remote unauthenticated attacker (CVSS PR:N) to replay captured OpenID Connect authentication material and impersonate a legitimate user, but only when OIDC SSO is configured and a real user completes an authentication (UI:R, AC:H). Affected versions are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; instances using other authentication methods are not exposed to this specific flaw. No public exploit identified at time of analysis.

Authentication bypass in Progress MOVEit Transfer allows an attacker who already holds a low-privilege authenticated foothold to reach protected functionality by traversing an alternate path or channel that skips the intended authentication and authorization checks, yielding high confidentiality and integrity impact at CVSS 8.8. Only MOVEit Transfer releases prior to 2025.1.6 and 2026.0.0 builds before 2026.0.4 are affected, and because the assessed vector carries PR:L the attacker must already possess some credentialed access, which narrows the exposure compared with an anonymous pre-auth bypass. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor issued a Critical Security Bulletin for this issue, making prompt patching the priority.

Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.

Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.

A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.

Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.

Unauthenticated remote code execution affects Komodo through 2.3.3 via its Periphery agent, which fails open when its core_public_keys and passkeys allowlists are left empty - the shipping default. Any attacker who can reach the agent's TCP port 8120 can present a self-generated keypair, be accepted as a trusted Core, and issue Periphery API calls that include terminal sessions and container operations, resulting in command execution on managed hosts typically as root. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality/integrity/availability), consistent with an independent assessment of CVSS 3.1 9.3; no public exploit code and no CISA KEV entry were identified at time of analysis, though the default-configuration exposure makes exploitation trivial wherever port 8120 is reachable.

Missing authorization checks in VentureDrake Laravel CRM before 2.4.0 allow any authenticated user holding a low-privilege Spatie role - including read-only accounts - to modify deals, quotes, orders and invoices by invoking Livewire action methods such as delete, won, lost or reopen on components like DealIndex, or by reaching the unguarded Activities and Products routes. The flaw is rated CVSS 4.0 7.1 (High) and requires only a valid non-privileged login (PR:L), with no user interaction and no administrative rights; the integrity impact is high while confidentiality and availability are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available in version 2.4.0.

Missing authorization in Papermerge Core through 3.5.3 lets any authenticated user seize control of documents and folders they do not own by supplying the victim's node UUID to the shared-nodes API, then granting themselves an arbitrary role to read, modify, delete, or unshare those nodes. Exploitation requires a valid low-privileged account and knowledge of the target UUID (which is a non-enumerable random identifier, reflected as the AT:P attack-complexity component in the assessed vector), so opportunistic mass exploitation is impractical and real risk concentrates in multi-tenant or shared-link environments where UUIDs may leak. The vendor has released a fix, and no public exploit was identified at time of analysis.

Missing authorization in Swetrix's ProjectController.addProject allows any authenticated user - including a self-registered low-privilege account - to hijack an arbitrary project by moving it into an organisation they control, simply by submitting the victim's public tracking ID. Once ownership is transferred, the attacker can read the project's analytics, change its settings, or delete it, with no victim interaction required; the only prerequisites are an account on the same Swetrix instance and knowledge of the target's tracking ID, which is intentionally exposed in client-side tracking snippets. Exploitation is limited to individually targeted projects (one tracking ID per hijack) with no cross-system scope change, and no public exploit code has been identified at time of analysis, though the flaw is a genuine, actionable broken-access-control issue (CVSS 8.7 4.0 / 8.8 3.1, CWE-862) fixed in Swetrix 5.1.0.

SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.

Missing authentication in NullHub through 2026.5.29 exposes the /api/* management API, so any remote attacker who can reach the listener can control agent instances, rewrite configuration including provider credentials, and manage cron jobs and MCP servers. The root cause is the auth_token field defaulting to null and never being assigned, meaning requests sent without Authorization and Origin headers are accepted without credentials (CWE-306). Exploitation requires the API to be bound to a non-loopback interface - the deployment pattern reflected in the project's Dockerfile - and once that exposure exists there are no further attacker prerequisites; severity is rated 9.2 and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as a genuine high-priority issue rather than a CVSS-inflated one. No public exploit code was identified at the time of analysis, and the issue is not confirmed as actively exploited.

Missing authorization in jshERP through 3.6 lets any authenticated low-privilege user hit POST /user/batchSetStatus and mass-change account status for other users in the same tenant, disabling every non-owner account - including administrator accounts - or re-enabling previously disabled ones. Exploitation requires only a valid low-privilege account and network reachability to the endpoint (CVSS PR:L, no user interaction), which confines realistic risk to insiders or anyone who can obtain low-privilege credentials. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 score of 7.1 (HIGH) and the independent 3.1 assessment (7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) are driven almost entirely by availability impact, with confidentiality untouched and integrity only partially affected.

youlai-mall through commit 9f62de8 fails to enforce member-level ownership on its app order-list endpoint, allowing any authenticated member to enumerate and read every customer's order records-including order IDs, order serial numbers, member IDs, payment amounts, and order statuses. The flaw is a missing authorization check (CWE-639) exploitable with a self-registered low-privilege account; no public exploit code or active exploitation is confirmed at time of analysis. The independent assessment rates this as a high-confidentiality, read-only disclosure with no integrity or availability impact, and exploitation requires the affected instance to expose the app order endpoint to authenticated users.

Authentication bypass in vlife through 2.0.1 enables unauthenticated remote attackers to forge HS256 JSON Web Tokens using a hardcoded signing key, granting super administrator access to any URL on affected instances. The vulnerability carries a CVSS 9.3 (CVSS:4.0) and CWE-321, with all default installations affected because the key is embedded in the open-source TokenUtil class. Exploitation requires only network reachability; no public exploit code has been identified at time of analysis.

Authenticated buyers on BizSpring Shop and BizSpring Java Mall (BizSpring Shop through commit cf22d39daaf1; Java Mall through commit 369e88c5) can mark orders as paid without any real payment by first generating a payment log via /member/payment/load and then invoking the test/debug handler /member/payment/test_post_pay_{paymentLogSn} (PaymentController.testPostPay). The handler performs no authenticity verification of the payment (CWE-345), so an attacker can obtain goods for free, and by supplying another member's paymentLogSn can also settle other users' orders through an IDOR variant. The flaw is rated CVSS 4.0 base 7.1 (AV:N/AC:L/PR:L/UI:N, high integrity impact) and CVSS 3.1 7.1; it is not listed as confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis, although the underlying technique is documented in public HackMD writeups.

Missing authorization in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, in all versions through 7.5.12, lets unauthenticated remote attackers invoke plugin functionality that should be gated behind an access-control check, rated CVSS 3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The accessible functionality yields only low confidentiality, integrity and availability impact rather than full site compromise, and real-world exposure is bounded by the narrow install base of this specialized pay-per-view videochat plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated OS command injection in TR7 Cyber Defense Inc.'s TR7 ASP appliance (both virtual and physical deployments) allows any attacker who can reach the appliance's exposed service to execute operating-system commands without supplying credentials or user interaction. The flaw is rooted in a missing authentication check for a critical function (CWE-306) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity, and availability of the appliance if exploited. All TR7 ASP installations running 1.0.40.236 up to (but not including) 1.0.1554.2331, or 1.6.42.239 up to (but not including) 1.6.1554.2331, are affected; exposure is the primary gating factor, since appliances segmented onto trusted management VLANs are far harder to reach. No public exploit code and no CISA KEV entry have been identified at time of analysis, and no EPSS score was provided with the source data.

Missing authorization in the handleLocalTerminal WebSocket handler of Skyhook Radar before 1.12.2 lets an attacker who can reach the /api/local-terminal endpoint spawn an interactive /bin/bash -l shell on the Radar host with Radar's own kubeconfig and process credentials injected into the environment, achieving remote code execution with Radar's privileges. The handler is governed only by a runtime-mode check instead of role-based access control, and per the advisory the exploit still works when the operator has set --disable-local-terminal, so that flag cannot be relied on as a mitigation in vulnerable builds. The vendor's CVSS 4.0 rating is 8.7 (VC:H/VI:H/VA:H, PR:L) while our independent reassessment scores it CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning authentication is not reliably enforced despite the PR:L marking; there is no CISA KEV entry and no public exploit code identified at time of analysis, and real-world exposure is chiefly limited by the fact that Radar is a local-first developer tool that is normally bound to localhost on an individual workstation.

Second-factor authentication bypass in TSplus Remote Access lets an attacker who already holds a valid username and password complete the login without ever supplying a valid MFA token, granting access to the protected applications and resources that MFA was meant to guard. The flaw is authenticated (PR:L) and remotely reachable over the network (AV:N) with no user interaction required, and it carries high confidentiality, integrity, and availability impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 8.7). No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); however, because the defect neutralises a control that many operators rely on as their primary protection for a remote-access gateway, it warrants priority remediation regardless of the absence of exploitation telemetry.

Missing authorization in the Crocoblock JetFormBuilder WordPress plugin through version 3.6.6 allows unauthenticated network attackers to reach an improperly access-controlled endpoint, with the assessed impact being availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Per the independent assessment, exploitation requires a site with an affected version where the specific vulnerable plugin action is reachable, and no public exploit was identified at time of analysis. Signals are mixed and point to a moderate, not top-tier, priority.

Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.

Unauthenticated remote attackers can disable every installed plugin on JTL-Shop installations - including payment and shipping integrations - by toggling the plugin safe mode through the administration backend's logout route, which is processed before the request's authentication state is checked (CWE-306). The attack needs a single request, no credentials and no user interaction, and can be automated across many installations to produce a shop-wide denial of service; CVSS v4.0 rates it 8.7 with availability-only impact, and no public exploit code or CISA KEV listing was identified at time of analysis. Because the flaw lives in middleware ordering, exploitation works against default configurations wherever the admin backend is network-reachable, and impact is confined to availability - no data disclosure or code execution.

Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.

Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.

Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.

Unauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access control weakness to read information from the device, make unauthorized changes, and knock it offline. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) confirms the attack requires no credentials and no user interaction, with the dominant impact being a high-availability Denial of Service and limited confidentiality and integrity effects. No public exploit code was identified and there is no CISA KEV listing at time of analysis; Ubiquiti's Security Advisory Bulletin 070 is the authoritative source for affected firmware and fixes.

Stored cross-site scripting (XSS) in the Verified Reviews (Avis Vérifiés) WordPress plugin up to version 2.4.6 allows unauthenticated attackers to inject arbitrary web scripts via the 'moderation' parameter, which execute when a user views an affected page. The plugin's ntav_check_data() function uses loose '!=' comparisons, enabling signature verification bypass by sending a JSON body with boolean true for idWebsite and sign. No public exploit identified at time of analysis; CVSS 3.1 score is 7.2 (HIGH).

Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.

Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.

Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.

Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.

Privilege escalation in the Ignition Perspective module (Inductive Automation Ignition) - a genuine high-priority issue in an OT/ICS context - allows an authenticated user with legitimate access to a Vision project to supply their valid Vision session identifier and obtain Designer-level privileges, leading to arbitrary code execution in the context of the Ignition Gateway process. The flaw (CWE-863, CVSS 8.7) affects Gateways where both Vision and Perspective modules are deployed, requires low-privilege Vision credentials and a valid session, and needs network reachability but no user interaction. No public exploit identified at time of analysis.

Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.

Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.

A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.

Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.

Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.

Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.

Improper input validation in Adobe's CAI Content Credentials SDK (advisory APSB26-163) lets remote attackers bypass a security feature and obtain unauthorized write access, effectively allowing modification or forgery of protected content-credential data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) means the flaw is network-reachable, low complexity, unauthenticated, and requires no user interaction, so any application or service that embeds the SDK and exposes its input-processing path to untrusted input is in scope. Impact is confined to integrity (I:H) with no confidentiality or availability loss, and no public exploit code or CISA KEV entry was identified at time of analysis.

Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.

Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.

Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security control and obtain unauthorized write access. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any deployment that exposes the vulnerable SDK input path to attacker-supplied content credentials data is reachable without credentials or user interaction, and the impact is integrity-only (C:N/I:H/A:N), meaning tampering with data rather than disclosure or denial of service. Rated CVSS 7.5 (High) and reported directly by Adobe PSIRT via advisory APSB26-163; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated remote attackers bypass the SDK's content-credential validation path and gain unauthorized write access, yielding an integrity-only impact (C:N/I:H/A:N, CVSS 7.5). Any deployment that ingests attacker-supplied or externally sourced credential data and runs the vulnerable SDK version through its parse/verify routine is exposed; no authentication (PR:N) and no user interaction (UI:N) are required per the assessed vector, so a default-configured verification service reachable from the network is sufficient. The practical limiting factor is deployment scope rather than a configuration toggle - the flaw only matters where untrusted content actually flows into the SDK - and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) at the time of writing, which keeps this an elevated but not top-tier priority.

Improper certificate validation in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass security features and gain unauthorized write access (CVSS 7.5, High). Exploitation requires the attacker to present a forged or untrusted certificate that the SDK incorrectly accepts, and no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Improper certificate validation in Adobe's CAI Content Credentials SDK (Content Credentials SDK) allows remote, unauthenticated attackers to bypass certificate trust checks and gain unauthorized write access, effectively letting them forge or tamper with signed Content Credentials data with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5). Impact is bounded to integrity - no confidentiality or availability effect - and only deployments that actually invoke the SDK to validate Content Credentials certificates are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; exploitation in practice requires the attacker to supply crafted signed content or hold a man-in-the-middle position on the certificate validation path.

Improper certificate validation (CWE-295) in the CAI/Adobe Content Credentials SDK allows an unauthenticated remote attacker to have forged or self-signed signing certificates accepted during C2PA manifest verification, bypassing the provenance trust check and enabling unauthorized write (integrity) impact - CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No user interaction is required, but exploitation is not automatic: the attacker must get crafted content into a workflow that validates it with the vulnerable SDK, or occupy a trust/transport position from which a malicious certificate is presented, which is narrower in practice than the network-vector score implies. There is no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to integrity, with no confidentiality or availability loss indicated.

Improper input validation in the CAI Content Credentials SDK lets remote, unauthenticated attackers bypass the SDK's security control and obtain unauthorized write access to content-credential data, per Adobe advisory APSB26-163. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity flaw requiring no authentication and no user interaction, with impact confined to integrity - confidentiality and availability are unaffected. Only applications that embed a vulnerable version of the SDK and expose its input-processing/validation path to network-supplied content are affected, and no public exploit code was identified at time of analysis.

Improper input validation in the Adobe CAI Content Credentials SDK lets remote attackers bypass a security feature and gain unauthorized write access to content-credential processing. The flaw is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction (UI:N), yielding a CVSS 3.1 score of 7.5, but the scored impact is integrity-only (C:N/I:H/A:N) rather than code execution or data disclosure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation is contingent on a deployed application embedding the SDK and exposing its C2PA manifest parsing/validation path to attacker-supplied input.

Improper certificate validation in the CAI Content Credentials SDK enables a network-positioned attacker who can intercept TLS connections to bypass security features and gain unauthorized write access. Exploitation requires a man-in-the-middle (MITM) position to supply a forged or invalid certificate that the SDK accepts; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, and although the input CVSS 7.5 vector lists AC:L, our assessment raises attack complexity because the MITM prerequisite limits opportunistic mass exploitation. No user interaction or credentials are needed once the MITM position is obtained. No public exploit identified at time of analysis.

Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthorized write access, a 7.5-rated integrity flaw confirmed by Adobe PSIRT. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials and no user interaction are required; the practical precondition is that an application embeds the SDK on a network-reachable code path that processes untrusted, externally supplied content. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the medium-to-high severity and the SDK's role in provenance validation make it a priority for integrations that ingest third-party content.

Improper access control in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security check and gain unauthorized write access, with no user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The impact is scoped entirely to integrity - the assessed vector shows no confidentiality or availability effect - so practical exposure depends on how much a deploying application trusts Content Credentials data for provenance or security decisions. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; Adobe advisory APSB26-163 is the authoritative source for affected and fixed SDK versions.

Improper access control in the Adobe CAI Content Credentials SDK lets unauthenticated, network-reachable attackers bypass a security check and obtain unauthorized write access to content-credential (provenance) data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) confirms the flaw needs no credentials and no user interaction, and that impact is confined to integrity - there is no confidentiality or availability effect. The practical exposure hinges on integration: this is an SDK, so reachability and real-world impact depend entirely on whether the host application exposes the affected access-controlled operation to attacker-controlled input; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted input into the SDK's processing path and bypass its integrity and security checks, resulting in unauthorized write access to Content Credentials data. Adobe PSIRT rates the issue CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning no privileges, no authentication, and no user interaction are required, and the impact is confined to integrity - forged or tampered provenance data - with no direct confidentiality or availability loss. Exposure is the limiting factor: since the SDK is a specialized provenance component, real risk depends on whether a downstream application actually accepts untrusted input through the vulnerable code path; there is no public exploit identified at time of analysis and no evidence of active exploitation.

Remote unauthenticated authorization bypass in IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let attackers reach resources or operations beyond their intended privileges, with high confidentiality and integrity impact and no availability impact. The defect is CWE-863 incorrect authorization, and the supplied sources do not describe the specific trigger, feature, or configuration involved. No public exploit identified at time of analysis; EPSS is 0.33% (24th percentile), while the vuln.today decision label is act_now and CISA SSVC records exploitation none with total technical impact.

Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an incorrect authorization check (CWE-863) combined with a scope change lets crafted file content escape the application's intended security boundary and run code as the current user. Photoshop builds 27.10 and earlier and 26.11.7 and earlier are affected, and exploitation hinges on convincing a victim to download and open the malicious file (AV:L, PR:N, UI:R), which makes phishing or poisoned shared assets the realistic delivery path rather than any remote or network-facing vector. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuinely serious but not emergency-tier issue; a vendor advisory (APSB26-158) is available.

Authentication bypass in IBM WebSphere Application Server - Liberty (17.0.0.3 through 26.0.0.10) allows remote, unauthenticated attackers to subvert the SAML 2.0 web single sign-on flow when the samlWeb-2.0 feature is explicitly enabled, resulting in a session fixation condition that yields high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Because samlWeb-2.0 is an opt-in Liberty feature rather than a default, only deployments that have configured SAML SSO are in scope; in practice exploitation is most credible when a legitimate user subsequently authenticates through an attacker-influenced session, which is a practical limiting factor relative to the raw vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (no CISA KEV listing), and no EPSS score was supplied with the available intelligence.

Access control bypass in IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 allows an unauthenticated remote attacker to call gRPC service methods while evading configured Liberty access controls. This is a genuine high-priority issue by multiple signals, with CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but practical impact is deployment-specific: it matters mainly where gRPC services are deployed and method-level access controls are relied upon. No public exploit identified at time of analysis and no CISA KEV confirmation was provided.

Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) stems from an incorrect authorization flaw (CWE-863) in a component that is restricted to the administrative network zone by default, letting an attacker who can reach that zone bypass authorization checks and execute code in the context of the current user without authentication or user interaction. The 9.6 CVSS score reflects a scope-changed (S:C) impact in which the compromised component can affect resources beyond its own security boundary, but the adjacent-network vector (AV:A, PR:N, UI:N) means the real-world exposure hinges on segmentation: organizations that properly firewall the ColdFusion administrative interface from ordinary users are largely insulated, while flat networks, exposed admin interfaces, or an existing internal foothold remove the only barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.

Arbitrary code execution in Adobe ColdFusion 2023 and 2025 is achievable through an incorrect authorization flaw (CWE-863) in a component that is, by default, reachable only from the administrative network zone. Exploitation requires two prerequisites confirmed by the assessed vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.4): the attacker must already be positioned on the adjacent administrative network segment, and must hold a high-privilege ColdFusion account; no user interaction is required and complexity is low once those conditions are met. There is no public exploit identified at time of analysis, so this is a serious but constrained flaw rather than a drop-everything internet-facing emergency - exposure is concentrated in organizations that expose the ColdFusion administrative zone broadly or allow high-privilege accounts to proliferate.

Incorrect authorization in Adobe ColdFusion 2023 (up to and including update 2023.0.25) and ColdFusion 2025 (up to and including update 2025.0.13) lets remote, unauthenticated attackers read contents of sensitive memory without any user interaction. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as an authentication bypass (CWE-863), so confidentiality of server-side data is the primary exposure rather than code execution or data modification. No public exploit code or exploitation telemetry has been identified at time of analysis, and no CISA KEV entry is associated, so the practical risk is governed mainly by whether a vulnerable, internet-facing ColdFusion instance is reachable.

Incorrect authorization in Adobe ColdFusion 2023 (through update 2023.0.25) and ColdFusion 2025 (through update 2025.0.13) allows an authenticated low-privileged attacker to bypass security controls and gain unauthorized write access, enabling modification of protected resources. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and a changed scope, with the primary impact being high integrity loss and low confidentiality loss; no public exploit code or active exploitation has been identified at the time of analysis. This is assessed as a genuinely high-priority issue due to the ease of exploitation once a low-privilege foothold is obtained.

Arbitrary code execution in Adobe ColdFusion (2023 at or below 2023.0.25, and 2025 at or below 2025.0.13) arises from an incorrect authorization flaw (CWE-863) that allows a low-privileged, authenticated actor to bypass intended access checks and execute code in the context of the current user, with no user interaction required. The vendor-assigned CVSS 3.1 base score is 8.8 (High) with a changed scope (S:C) and high impact across confidentiality, integrity and availability. The vector specifies a local attack path (AV:L) requiring low privileges (PR:L), which is consistent with the assessment that an attacker must already hold a low-privileged ColdFusion account or session; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Incorrect authorization in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an authenticated, locally-positioned low-privileged attacker to execute arbitrary code in the context of another user, with a changed security scope. The flaw maps to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8): exploitation requires an existing low-privilege account or session plus local access to the server or application context, and it needs no user interaction. No public exploit has been identified at time of analysis, and the high confidentiality, integrity and availability impact is bounded by the fact that an external unauthenticated attacker cannot trigger the issue without first obtaining a foothold and valid low-privilege credentials on an unpatched instance.

Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged attacker with local access to execute arbitrary code under the context of the current user without user interaction (CVSS 8.8, scope changed). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but the Adobe PSIRT 'Authentication Bypass' tag suggests the authorization barrier may be weaker than the PR:L metric implies-defenders should verify the true prerequisite set in APSB26-144. Organizations running affected builds should treat this as a credible priority while confirming whether any authenticated session is truly required.

Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.

Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.

Authenticated low-privileged users on Adobe ColdFusion 2023 through 2023.0.25 and ColdFusion 2025 through 2025.0.13 can exploit an incorrect authorization weakness (CWE-863) to execute arbitrary code in the context of the current user, with changed scope extending impact beyond the vulnerable component. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8), so an existing low-privileged account is required and no user interaction is needed; the AV:L value suggests local/console-adjacent access even though the supplied tags include Authentication Bypass and RCE. No public exploit was identified at time of analysis; this is a high-severity, high-priority flaw warranting prompt patching, but the attack-vector and tag conflict should be confirmed with Adobe.

Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is achievable by a low-privileged, locally positioned attacker who abuses an incorrect authorization flaw to escalate into code execution in the context of the current user. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C, score 8.8) shows the barrier is a valid low-privileged account plus local/session reach to the server rather than unauthenticated network access, and no user interaction is needed. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is real but is gated by the authenticated-plus-local prerequisites, keeping it below a pre-authentication remote code execution scenario.

Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 through update 2023.0.25 and ColdFusion 2025 through update 2025.0.13 enables a low-privileged authenticated attacker to bypass security measures and gain unauthorized write access over the network without user interaction. This moderate-priority vulnerability has a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), reflecting a scope change and high integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Adobe advisory APSB26-144 provides mitigation guidance.

Incorrect authorization handling in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an attacker who already holds a low-privileged ColdFusion session or local access to the server to bypass authorization checks and execute arbitrary code in the context of the current user, with no user interaction required. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C) makes clear this is not an anonymous remote flaw despite the 'Authentication Bypass' tag - obtaining a low-privileged account or local foothold is the gating prerequisite, after which complexity is low and impact is high across confidentiality, integrity, and availability with a scope change. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited; a vendor fix is available via Adobe advisory APSB26-144, so systems already patched past 2023.0.25 / 2025.0.13 are not affected.

Incorrect authorization in Adobe ColdFusion 2023.0.25 and earlier and 2025.0.13 and earlier allows an authenticated low-privileged attacker to execute arbitrary code in the context of the current user, but only when a victim opens a malicious file supplied by the attacker. The local access vector and required user interaction mean the flaw is not directly reachable through a network request against an exposed server without a prior foothold; no public exploit code or active exploitation has been identified at time of analysis. Adobe has released security advisory APSB26-144 covering affected versions.

Insufficient isolation in WebSphere Liberty 17.0.0.3 through 26.0.0.10 allows an authenticated attacker who already has low-level privileges on one server instance to cross into other server instances that share the same installation, yielding high confidentiality and integrity impact with a changed scope (CVSS 8.2). Exploitation is conditional: it requires a shared or consolidated install topology and a pre-existing foothold on a co-located server, and the assessment rates this as a genuine but conditional priority rather than a mass-exploitation threat. No public exploit identified at time of analysis.

Cryptographic signature verification bypass in IBM WebSphere Application Server 8.5 and 9.0 and WebSphere Liberty 17.0.0.3 through 26.0.0.10 lets a remote, unauthenticated attacker forge or tamper with signed content that the server should reject, undermining trust in signed tokens and messages (CVSS 8.7, scope-changed integrity and confidentiality impact). Exploitation requires High attack complexity - the attacker must satisfy conditions outside their control when crafting input to reach the flawed verification path - so only deployments that process and validate signed input are realistically exposed. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.

Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.

Missing authorization in Visual Studio Code allows code execution in the context of the editor's local user when a victim opens attacker-controlled content, such as a malicious workspace, repository, or file; the flaw affects versions from 1.0.0 up to but not including 1.141.1. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no prior authentication is needed on the target, but successful exploitation still hinges on the mandatory user-interaction step, and the resulting impact stays within the user's own session rather than crossing a privilege or scope boundary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible patch-priority for developer endpoints rather than a drop-everything internet-facing emergency; Microsoft rates the fix as available.

Broken access control in Omnispace Agora Project releases before 26.10.0 lets an authenticated space administrator assign users into spaces that lie outside their own authority, breaking tenant isolation in multi-tenant deployments. The flaw sits in the user import flow's join INSERT, where the spaceAffectList affectation is written without the readRight() authorization check on the target space, so a caller holding space-admin rights on one space can manipulate user-space assignments in spaces they should not control (CWE-862, CVSS 8.6 v4.0; assessed as CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a pre-existing space-administrator account and is only meaningful where separate tenants/spaces are relied upon for isolation; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).

Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).