Authentication Bypass

Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.

Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.

Missing authorization in the Pubjet WordPress plugin (versions up to and including 5.4.8) allows an authenticated attacker with subscriber-level privileges to change plugin settings, resulting in a high integrity impact (CVSS 7.6). Exploitation requires the target site to permit user registration or the attacker to obtain valid low-privilege credentials, making open registration a primary exposure factor. No public exploit code has been identified at time of analysis, and the flaw is classified as CWE-862 (Missing Authorization).

Broken access control in the Wordable WordPress plugin (versions up to and including 8.2.10) lets any authenticated Subscriber-level account invoke functionality that should be reserved for higher-privileged roles, yielding high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Reported by Patchstack and rooted in a missing-authorization condition (CWE-862), the issue requires the attacker to already hold or be able to register a low-privilege account, so real-world risk is much greater on sites permitting open user self-registration than on sites where account creation is locked down. No public exploit code was identified at the time of analysis, the CVE is not listed in CISA KEV, and no EPSS data was supplied; treated as a genuine priority-tier vulnerability with a meaningful authentication caveat, it warrants prompt review of plugin exposure and user-registration settings.

Broken access control in the WPSection WordPress plugin through version 1.5.1 allows an authenticated subscriber-level user to perform privileged actions that should be restricted to higher-privileged roles, resulting in high integrity and availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw is a missing authorization check (CWE-862): the plugin does not verify that the calling user holds the capability the action demands, so any valid low-privileged account on an affected site - the description explicitly cites the Subscriber role - can trigger the vulnerable code paths without user interaction. Only sites running WPSection 1.5.1 or earlier that allow subscriber-level or comparable self-registration are realistically exposed, since an anonymous visitor cannot reach the functionality; no public exploit identified at time of analysis, and the plugin's narrow deployment base limits mass exploitation.

Missing authorization checks in the Bayarcash WooCommerce WordPress plugin (all versions through 4.4.2) let unauthenticated remote attackers reach functionality that should be restricted to privileged users, allowing unauthorized changes to payment-related configuration or transaction state. The flaw carries CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), i.e. network-reachable, low complexity, no credentials and no user interaction, with a pure integrity impact and no confidentiality loss or denial of service. Exposure is bounded by deployment scope rather than configuration: the site must be running the plugin, and because Bayarcash is a Malaysia-focused payment gateway the realistic victim set is merchants using that gateway. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Missing authorization in TencentCloud Octop through 1.0.2b6 lets any authenticated low-privileged user retrieve plaintext LLM and voice provider API keys by calling GET /api/providers and GET /api/voice/providers. Those routes validate the caller's JWT but perform no role, tenant, or ownership check, so in multi-user or multi-tenant deployments any account holding a token is sufficient to harvest credentials and abuse the upstream provider accounts; a single-operator install is largely limited to the legitimate owner reading their own keys. Independent assessment rates this as a genuine moderately-high confidentiality flaw bounded by the PR:L prerequisite (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and the current exploitation status is: no public exploit identified at time of analysis, despite a public technical writeup and upstream pull requests referencing the issue.

Incorrect authorization in iflytek SkillHub before 0.2.22 allows account takeover via the self-service account-merge flow: the merge-initiate endpoint returned the verification token directly to the caller and the verify/confirm steps never required the target account to approve from its own authenticated session, so a single low-privilege authenticated user who knows a victim's username or OAuth identity can complete a merge and inherit that victim's API tokens, roles and namespace ownership. Exploitation requires only a valid SkillHub session (PR:L per the CVSS vector - no administrative rights) and works against default deployments because the API enforces the flow even though the /settings/accounts UI remains redirected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the attack is low-complexity and high-impact, warranting prompt patching; the vendor-released fix is SkillHub 0.2.22.

Missing authentication in the MAX platform adapter of cc-connect through 1.5.0 allows remote attackers to forge webhook updates and, by supplying an allowed or admin user_id, trigger privileged host commands such as /shell. The flaw only materialises when the MAX adapter is deployed in webhook mode with no webhook_secret configured and its listener on port 8080 is network-reachable; configuring a secret eliminates the exposure entirely. At time of analysis there is no CISA KEV entry, no vendor-released patch version published, and no public exploit identified, though the technical bar to exploitation is low once the misconfiguration is present.

AstronRPA through 1.1.6 exposes other tenants' credential-bearing shared variables to any authenticated low-privilege user, because robot-service's get-batch-shared-var endpoint applies no tenant authorization check to caller-supplied shared-variable IDs. An attacker can enumerate sequential IDs, request them in batch, and since the service re-encrypts all-users variables with the caller's own tenant key, the returned ciphertext decrypts to plaintext secrets belonging to other tenants. The provider-assigned CVSS 4.0 score is 7.1, our assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (confidentiality only), exploitation requires a valid account on a multi-tenant deployment, no public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided.

Information disclosure in Open Source Social Network (OSSN) through 10.1 allows authenticated users to read other users' private message attachments by requesting the /messages/attachment/{guid} route with sequential or guessed file GUIDs. The flaw is an insecure direct object reference (CWE-639) in the default attachment handler, which outputs a file whenever it is typed as a message attachment without verifying that the requesting user is the sender or recipient; no user interaction is required, but a valid low-privileged account and a valid attachment GUID are needed. Publicly available exploit code exists (a HackMD writeup), and a vendor-linked fix commit is referenced, though a released patched version is not independently confirmed, and there is no indication of confirmed active exploitation (CISA KEV).

Unauthenticated attackers can retrieve any customer's invoice, packing slip, delivery note, dispatch label or shipping label from WordPress sites running the WebToffee WooCommerce PDF Invoices plugin up to and including 5.0.2, exposed via the guest 'print_document_from_the_mail_link' handler. The handler authenticates document access by comparing a base64-encoded 'email' parameter against the order's billing email - a non-secret identifier - rather than the secret WooCommerce order_key, so anyone who knows a target order ID and that order's billing email can pull the full document contents (name, billing/shipping address, phone, products, prices, taxes, invoice metadata). Exploitation requires the site to be configured with guest document access ('wt_pklist_print_button_access_for' != 'logged_in'), so default logged-in-only configurations are not exposed; risk is rated CVSS 7.5 with high confidentiality impact but no integrity or availability impact, and no public exploit code has been identified at time of analysis.

Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.

Authentication bypass in the WPCOM Member WordPress plugin (all versions up to and including 1.7.27) allows remote, unauthenticated attackers to establish a fully authenticated WordPress session as any user, including administrators, by forging a session entry that the plugin's social-login callback later resolves to a victim's bound social identifier. The published CVSS is 9.8, but independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: exploitation is gated by two real-world prerequisites - the target must have at least one social login provider configured (which is what registers the vulnerable callback on the WordPress init hook), and the attacker must know or be able to enumerate the victim account's bound openid/unionid, with admin takeover specifically requiring the administrator's identifier. Cross-referenced sources show no CISA KEV entry and no public exploit code identified at time of analysis, so the practical risk is best characterized as a genuine high-priority issue whose severity is tempered by the non-universal configuration requirement and the prior-knowledge hurdle rather than a universally exploitable 9.8.

Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPress theme (versions through 1.4.108) due to missing authorization checks (CWE-862). The flaw is network-reachable with low complexity and requires no authentication or user interaction, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 7.5). No public exploit identified at time of analysis, and there is no indication of active exploitation (CISA KEV).

Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.

Authorization bypass in the JoomUnited WP File Download plugin for WordPress (all versions up to and including 6.3.9) allows any authenticated user with subscriber-level access or above to permanently delete any file managed by the plugin, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. The flaw is a missing authorization check (CWE-862), meaning the plugin's action handlers never verify that the caller holds a capability appropriate for the requested operation, so the lowest-privilege WordPress role is sufficient. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the barrier to exploitation is low because subscriber accounts are frequently obtainable through open self-registration; the assessed CVSS 3.1 base score is 8.1 (High) with high integrity and availability impact and no confidentiality impact.

Unauthenticated authentication bypass in the SMS Alert WordPress plugin before 4.0.1 lets an attacker log in as any user who has a phone number stored in their profile - including an administrator - by completing an SMS one-time-code challenge on a phone the attacker controls. The plugin validates the code itself but never verifies that the verified code belongs to the account being logged into, so the OTP check can be satisfied for one phone while the resulting session is issued for a different, targeted account. This is a high-severity (CVSS 8.1, CWE-287) issue, but exploitation is constrained: the SMS/OTP login path must be enabled and the target account must have a stored phone number, and no public exploit or confirmed active exploitation has been identified at time of analysis; the vendor has released a fix in 4.0.1.

Unauthenticated attackers can delete a limited set of files on WordPress sites running the rtMedia for WordPress, BuddyPress and bbPress plugin through version 4.7.13, because the upload processing routine performs insufficient file path validation and the plugin treats a publicly exposed nonce as an authorization gate. The rtmedia_upload_nonce that guards the deletion path is emitted into frontend JavaScript by any page rendering the rtMedia gallery or upload shortcode, so it can be harvested by any anonymous visitor, although the impact is deliberately limited to files the plugin classifies as 'safe' rather than critical system or configuration files. Affected sites on 4.7.14 or later are not exploitable; no public exploit code was identified at time of analysis and there is no evidence of active exploitation. The assessing vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting limited integrity and availability loss rather than the higher confidentiality weighting in the originally published CVSS score.

Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.

Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).

Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.

Unauthenticated account takeover in Vikunja 1.0.0 through 2.3.0 lets an attacker who can obtain an OpenID Connect token carrying a victim's email address log in as that victim with a full session and no victim interaction. The flaw only manifests when an administrator has enabled the non-default per-provider emailfallback option, under which Vikunja resolves an unknown (issuer, subject) pair to a pre-existing local username/password account using the email claim alone - it never inspects email_verified (or Microsoft's xms_edov) and never asks for the matched account's password. Practical exposure is narrow but real: it additionally requires an IdP that will assert a victim's unverified email (a self-service or multi-tenant issuer) and a victim local account that has no TOTP, which the 2.3.0 enforceTOTPIfRequired gate protects; there is no public exploit identified at time of analysis, and no KEV/EPSS signal has been provided, so this is a high-priority fix for the specific vulnerable configuration rather than an ongoing mass-exploitation event.

Authenticated users can read records belonging to other users in AWS Amplify applications whose GraphQL backend was generated by @aws-amplify/graphql-index-transformer before 3.1.2, due to improper authorization in owner-scoped secondary-index query resolvers (CWE-639). This is a moderate-priority authorization bypass requiring a valid account on the same application (PR:L); no public exploit code has been identified at the time of analysis. The flaw affects applications using owner-authorized @index resolvers, and it is fixed in version 3.1.2 (included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4), with redeployment of the backend required.

Unauthenticated remote access to x64dbg-MCP Server prior to version 1.1 lets any network client that can reach the plugin's HTTP/SSE listener execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. The listener binds to 0.0.0.0 by default and, before the fix, Bearer token authentication was optional and disabled by default, so a default installation with a running x64dbg GUI is fully controllable without credentials (CWE-306), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied, so exploitation likelihood rests on exposure of ports 9094 (x64) or 9095 (x32).

Account takeover in Pingvin Share X 0.19.0 through 1.21.x allows remote attackers to seize arbitrary accounts - including administrator accounts - by registering a victim's email address on an enabled OAuth/OIDC provider that does not enforce email verification, then signing in through the OAuth flow, which auto-links to the victim's existing account without any email_verified check and bypasses TOTP. Successful exploitation yields full read/write access to the victim's files and settings as well as any administrative privileges the victim holds. The attack is unauthenticated (CVSS:3.1 PR:N/UI:N) but is not universally exploitable: it requires that the instance has an OAuth/OIDC provider routed through GenericOidcProvider, that automatic OAuth email linking is active, and that the attacker knows the victim's email address and can register it unverified on that provider - the AC:H/AT:P conditions reflected in both the assessed CVSS:3.1 vector (8.1) and the vendor's CVSS:4.0 score of 9.2. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor-released fix is available in 1.22.0.

Missing second-factor step-up enforcement in the Nginx UI cluster API (versions 2.0.0 through 2.4.x) allows anyone holding a valid session token to perform node CRUD operations, read or replace stored node credentials, change namespaces, and trigger cluster-wide Nginx reload or restart actions without re-verifying a one-time password. The api/cluster router is protected by AuthRequired but omits RequireSecureSession, so a stolen or persisted JWT belonging to an OTP-enabled user is sufficient; the flaw is an incomplete fix for CVE-2026-84315 and was corrected in version 2.5.0. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and exposure is limited to clustered/multi-node deployments reachable on the network, so this is a high-priority issue for that specific population rather than a mass-internet emergency.

Ordinary authenticated users of clustered Nginx UI deployments can read the cluster node token from the JSON responses of /api/nodes and /api/nodes/:id and replay it in the X-Node-Secret header to be authenticated as a trusted peer node, crossing the node-to-node authentication boundary. Because the leaked secret is accepted by AuthRequired and mapped to the synthetic initUser principal, the attacker can reach sensitive management operations on any network-reachable cluster member, including configuration synchronization and service restarts. Affected versions are 2.0.0 through 2.4.x; the issue is fixed in Nginx UI 2.5.0. No public exploit code or confirmed active exploitation was identified at time of analysis, although the upstream fix commit is publicly visible.

Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.

Account takeover in Nginx UI versions 2.0.0 through 2.4.x affects accounts configured with a passkey as their only second factor: the POST /api/login handler checks EnabledOTP but never requires a WebAuthn assertion when EnabledPasskey is true and no TOTP secret exists, so a valid password alone yields a fully authenticated session despite the account reporting a second factor. An attacker who already holds the account password can reach administrative Nginx UI functionality without possessing the registered passkey; accounts protected by TOTP, and accounts with no 2FA configured, are unaffected. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the AC:H metric reflecting the hard password precondition rather than any exploit complexity.

Authorization bypass in MOVO through 0.2.3 lets any authenticated user read other users' stored private documents and overwrite their presentation blueprints through the chat-api document endpoints, because the server accepts an attacker-supplied object path without verifying that the object belongs to the requester. Exploitation requires a valid MOVO account and advance knowledge or enumeration of the victim's object path, so the attack is bounded by path secrecy rather than being fully attacker-controlled, and no victim interaction is needed. Publicly available exploit code exists, and both the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N, C/I impact) agree the impact is a high-confidentiality, lower-integrity exposure confined to the vulnerable application rather than a platform-wide compromise; signals are moderately consistent and point to a real but bounded risk.

Credential exposure in Nginx UI 2.0.0 through 2.4.x allows anyone who recovers the Node.Secret master credential to bypass password, JWT, session, and second-factor checks and obtain persistent administrative API access to configuration and secret material. Versions in that range accept the Node.Secret through the node_secret query parameter on HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header, so the credential can leak into access logs, reverse-proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. Exploitation is conditional rather than trivial: node/cluster authentication must actually be in use, the secret must have been transmitted as a query parameter in practice, and the attacker must have read access to one of those sinks; no public exploit code has been identified at time of analysis, and the vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while our independent assessment scores it AV:N/AC:H/PR:N/UI:N with the same High confidentiality, integrity, and availability impact.

Red Lion Controls 700 Series devices expose SNMP functions that can be used to perform administrative operations - retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades - while the vendor's description states these actions require no authentication at all (CWE-306, missing authentication for a critical function). The issue is rated 9.3 in the published CVSS v4.0 score, and the independent assessment scores it as critical (CVSS 3.1 base AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality and integrity and a scope change from the network service to the device itself; availability is not scored as impacted. No CISA KEV listing or public proof-of-concept is present in the supplied intelligence, so the current status is no public exploit identified at time of analysis. One caveat worth resolving early: the published v4.0 vector carries PR:L (some privilege/credential), which contradicts the description's 'without any authentication' - confirm the exact SNMP access requirement against the vendor advisory before de-prioritizing, because if the description is correct the real-world severity is closer to the independent PR:N assessment.

Authentication bypass in PHPNuxBill through 2025.3.20 allows attackers on the adjacent network to log in as any customer via MikroTik hotspot or PPPoE CHAP by supplying any incorrect password, provided they know a valid username. This grants unauthorized network access and allows the attacker to consume that customer's plan. No public exploit has been identified at time of analysis, and the vulnerability is rated High severity (CVSS 4.0 base 7.1).

Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by configuring additional administrator accounts, so an attacker who can reach the device's management interface can log in with administrative privileges on a device that operators believe is fully hardened. The independent assessment rates this as a high-impact, effectively unauthenticated network-reachable issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), acknowledging that the supplied CVSS 4.0 vector marks PR:H while the defining feature - publicly known default credentials - means no legitimate account or privilege is required in practice. The practical limiting factor is reachability: ICS/OT networks are often segmented, so real-world exposure depends on whether the management interface is accessible from an attacker-controlled segment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor fix version is disclosed in the available data.

Remote unauthenticated attackers can gain full administrative control of openPDC deployments provisioned from the official published Docker image, because that image embeds a fixed administrative credential that is not forced to change on first use. Exploitation requires only network reachability to the management interface and retention of the default credential; source-built or manually provisioned instances that set their own credentials are not affected. No public exploit code has been identified at time of analysis, though the vulnerable condition is inherent to the image and the CVSS 4.0 base score is 9.3, highlighting the severity for exposed deployments.

Unauthenticated access to the openPDC internal data publisher lets any host that can reach the service connect and subscribe without credentials, tokens, or user interaction, retrieving the complete device and measurement topology - the full model of phasor measurement units, devices, and signal names that describes a synchrophasor deployment. The affected software set, per vendor CPE entries, covers openPDC, the openPDC Docker image, and openHistorian, with CISA ICS advisory ICSA-26-281-02 documenting the missing-authentication weakness (CWE-306); the assessed vector requires no authentication (PR:N) and yields a high-confidentiality, read-only exposure with no integrity or availability impact, so an attacker cannot alter or disrupt operations through this flaw alone. No public exploit identified at time of analysis, and realistic risk is dominated by network exposure: properly segmented OT/ICS networks sharply limit reachability, while flat networks or inadvertently internet-exposed publisher endpoints are fully exploitable.

Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock's communication protocol and bypass electronic lock and access controls without valid credentials, a PIN, or app pairing (PR:N, UI:N). The root cause is CWE-1204 cryptographic misuse, specifically weak initialization vector or related BLE protocol weaknesses, and exploitation is non-remote and does not scale because it requires per-target physical proximity within roughly 10 meters and interaction with live Bluetooth traffic. No public exploit identified at time of analysis; the risk is a targeted physical-intrusion issue that is narrower in reach than the 8.5 score alone suggests.

Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).

Authentication bypass in Apache CXF's OidcClientCodeRequestFilter renders the max_age authentication-freshness check inoperative, allowing stale OIDC sessions to be accepted regardless of age when a relying party has configured setMaxAgeOffset to enforce step-up re-authentication. The defect stems from a milliseconds/seconds unit mismatch and inverted comparison polarity, silently defeating session-age validation; affected releases are Apache CXF 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and 3.6.x before 3.6.13. Vendor patches are available, no public exploit identified at time of analysis, and EPSS is low (0.23%), though exploitation requires the non-default setMaxAgeOffset setting, limiting real-world impact to deployments that opt into max_age policies.

Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.

Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.

Authentication bypass in WPMU DEV Forminator (versions up to 1.57.2) allows unauthenticated remote attackers to spoof identity and bypass payment or other identity-dependent workflows on WordPress sites. The vulnerability requires a publicly reachable form-typically a payment-enabled or identity-verifying form-to be active. No public exploit identified at time of analysis; the primary impact is integrity, as attackers can forge trusted state but cannot read data or cause service disruption.

Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.

Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.

Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.

Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.

Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamper with a user-controlled key to reach resources and actions reserved for higher-privileged accounts, resulting in elevation of privileges with high impact to confidentiality, integrity, and availability. Only SCG Policy Manager builds below the vendor-fixed release are affected; exploitation requires an existing valid low-privileged account plus network reachability to the product interface, so fully unauthenticated outsiders cannot trigger it. Risk is real but not emergency-grade: EPSS is low at 0.18 percent (7th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. Vendor-released patches are available through Dell advisory DSA-2026-385.

Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.

Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.

Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid low-privileged account and network reachability to the appliance invoke privileged functionality that lacks a proper authorization check, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is not remote-unauthenticated - a pre-existing low-privileged credential is a hard prerequisite. No public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.16% (5th percentile), CISA SSVC rates exploitation as none and automatable as no, and a vendor patch is available.

Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.

Authentication bypass in the FalkorDB Bolt endpoint (src/bolt/bolt_api.c) affects all releases before 4.20.0 and lets a remote, unauthenticated attacker run graph queries without credentials, scored 9.2 Critical under the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) and assessed as high-impact under an independent CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Exploitation is gated by two concrete preconditions: the operator must have explicitly enabled the Bolt listener by setting BOLT_PORT (disabled by default, so stock deployments are not exposed), and the flaw only fires when the backing Redis answers an empty AUTH probe with an error other than WRONGPASS - specifically LOADING during dataset load, MASTERDOWN during replication failover, or OOM under memory pressure; in steady state with a password configured, the probe returns WRONGPASS and authentication is enforced normally. No public exploit code has been identified and the issue is not in CISA KEV, so the realistic risk sits with intentionally exposed Bolt endpoints that can be driven into those transient Redis states.

SessionManager rate-limit bypass in Argo CD v3.0.6 allows unauthenticated remote attackers to issue repeated concurrent crafted login requests and win a race-condition timing window, circumventing the login throttling intended to slow brute-force attempts. The CVSS 3.1 score is 8.1 with High confidentiality, integrity, and availability impact, but High attack complexity reflects the need to reliably win the timing race; follow-on account compromise is further limited by strong credentials, SSO/external identity providers, or secondary lockout controls. EPSS is low at 0.15% (4th percentile), and no public exploit was identified at time of analysis.

Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document selection or clipboard to be interpreted as command-line flags when an agentic CLI backend (Grok, Claude Code, or Codex) is configured as the translation provider. Because the vulnerable code builds the child process command line with quote-only escaping, attacker-controlled text can smuggle in flags that alter the model, working directory, approval mode, or sandbox settings used by the launched CLI. Exploitation is local and requires the user to actively invoke the translate/AI-chat action on the crafted text, and only affects installations where one of those agentic CLI backends is installed and selected; no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.

Improper certificate validation in Microsoft Partner Center allows a network-positioned attacker to impersonate the service and gain elevated privileges, with a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) though exploit maturity is unproven (E:U). Exploitation requires the attacker to intercept, relay, or inject into the TLS path and present a certificate the service wrongly accepts (CWE-295); no authentication or user interaction is needed, and no public exploit code has been identified. As a Microsoft-hosted cloud service, the fix is deployed centrally by Microsoft.

Authorization bypass in Microsoft Bookings allows unauthenticated remote attackers to elevate privileges by manipulating user-controlled keys. The flaw, tracked as CVE-2026-94510, stems from an insecure direct object reference (CWE-639) and carries a CVSS 3.1 base score of 9.9 due to scope change and high integrity impact. No public exploit code is known to be circulating, and Microsoft has applied a server-side patch to the hosted service.

Unauthenticated remote code execution is possible in Microsoft Azure App Service for Linux because a critical function is exposed without any authentication check (CWE-306). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), an unauthorized attacker can reach the vulnerable functionality over the network and trigger code execution with no credentials, no user interaction, and low attack complexity, yielding high confidentiality, integrity, and availability impact (CVSS 9.8). Microsoft has published an official fix through its MSRC update guide, and no public exploit code has been identified at time of analysis; the residual risk is concentrated on internet-reachable instances still running an unpatched version. The exact function or endpoint involved is not disclosed in the available data, so operators should treat any network-exposed Azure App Service for Linux deployment as potentially affected until patched or confirmed otherwise.

Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.

Authorization bypass in the Hazelcast IMap Predicates API allows a client holding only limited cluster credentials to execute arbitrary code on a Hazelcast cluster member in versions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0. Because the missing check sits inside the map permission model itself, a partially trusted client - for instance one granted read or put rights on a single map - can invoke the aggregation and projection query paths that were never gated by a permission bit, yielding full compromise of confidentiality, integrity and availability on the member (CVSS 4.0 base 8.7 High; vendor-assessed CVSS 3.1 8.7 with PR:L). Exploitation requires an authenticated client connection to the cluster, so it is not reachable by fully unauthenticated attackers; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor states no workaround exists other than upgrading.

Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.

Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.

Authentication and authorization bypass in fast-jwt 6.3.0 and earlier lets a remote, unauthenticated attacker submit a forged unsigned JWT containing arbitrary claims and have it accepted without possessing any signing key. The defect is reachable only when an application instantiates createVerifier with a falsy synchronous key (an empty string '' or null) while also supplying a non-empty algorithms allowlist such as ['HS256']; that combination causes prepareKeyOrSecret to be skipped, hasKey to evaluate false, and the empty signature segment of an unsigned token to bypass the verifySignature gate entirely. The issue is fixed in 6.3.1, and no public exploit code was identified at time of analysis - the primary real-world limiter is that the vulnerable configuration is non-default and developer-introduced, though once such a verifier exists no privileges or user interaction are required of the attacker.

Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthenticated remote attackers to invoke arbitrary management operations against the affected appliance, with the highest possible impact to confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the CVSS vector specifies PR:N with no user interaction and no non-default configuration prerequisite, any network-reachable management interface or API endpoint on an affected version is potentially exploitable without credentials; the practical constraint is reachability, since Guardium management planes are typically confined to internal or dedicated management segments. At time of analysis there is no CISA KEV entry and no publicly available exploit code identified, so exploitation is assessed as technically straightforward but not yet observed in external telemetry.

IBM Guardium Data Protection 12.0, 12.1, and 12.2 ship with hard-coded credentials that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can abuse to read sensitive information from the affected appliance service, yielding a high confidentiality impact with no integrity or availability loss (C:H/I:N/A:N, base 7.5). Exploitation is not trivial in practice: the attacker must first know or recover the static credential value and must be able to reach the Guardium management or data service over the network, which is typically an internal, segmented appliance rather than an internet-facing endpoint. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.30% (21st percentile), so this rates as a genuine but moderate-priority exposure that should be scheduled rather than emergency-patched.

Local privilege escalation in Deskin 3.3.4.3 and earlier on macOS allows any local unprivileged process to gain full root by connecting to the root-owned com.deskin.service.installer XPC service, which performs no client authentication, and invoking its privileged installer method with an attacker-supplied installer package. Because the flaw (CWE-306) sits on a local Mach/IPC path, an attacker must already hold a local account or code-execution foothold on a host where Deskin is installed and the installer service is running, making it a post-compromise escalation primitive rather than an initial access vector. Publicly available exploit code exists (GitHub PoC, reported via VulnCheck) but there is no confirmed active exploitation (CISA KEV) at time of analysis; the submitted CVSS 4.0 score of 8.5 and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both reflect high confidentiality, integrity and availability impact once the local prerequisite is satisfied.

Improper authorization enforcement in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can allow unauthenticated remote attackers (PR:N, UI:N) to bypass access controls and alter protected content or state (I:H, C:N, A:N) when the product is deployed in front of certain web servers. The flaw, however, is configuration-dependent: as reflected by the AV:N/AC:H vector and IBM's scoping to 'some' web servers, only specific protected web-server integrations are exposed, and default or unaffected setups are not exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM rates the issue 5.9 (moderate); the affected deployments also include the containerized editions of both products.

Authentication bypass in IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, allows a remote, unauthenticated attacker to defeat security restrictions and gain unauthorized access to functionality that should be protected. With a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:N), the flaw is network-reachable, low complexity, and requires no credentials or user interaction; the impact is rated as high on integrity, meaning an attacker can alter protected data or configuration through the bypass. The only practical precondition is that the affected authentication or management interface be reachable by the attacker. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM advisory node 7291628.

Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the containerized editions) allows a remote attacker who already holds valid credentials to slip crafted parameters into command or process arguments and trigger unauthorized actions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires authenticated access (CVSS vector PR:L) and no user interaction (UI:N), so the exposed population is limited to existing platform users rather than anonymous internet traffic. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and the affected systems are typically high-value identity infrastructure, making prompt remediation worthwhile.

Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container editions) allows a remote, unauthenticated attacker to defeat the product's authentication control entirely, with no user interaction required. The 7.5 CVSS score reflects a high integrity impact only - the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) assigns no confidentiality or availability impact - so the practical effect is that an attacker can perform authenticated actions with the privileges of a legitimate session while exposing no data directly. IBM has published a vendor fix via support node 7291628, and no public exploit code has been identified at time of analysis; this is a credible operational priority but not a confirmed emergency.

Authentication bypass in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 lets unauthenticated remote attackers reach functionality that should require a valid login, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, with high impact on confidentiality and integrity (C:H/I:H/A:N) and no reported availability impact. Any iMC instance running a build older than v7.3 E0713 and reachable over the network is exposed, and because iMC is an enterprise network management platform, compromise can expose managed-device credentials and configuration data and allow unauthorized changes. No public exploit code was identified at time of analysis and the CVE is not confirmed as actively exploited (CISA KEV), though the vendor advisory and the 9.1 base score warrant urgent patching on internet- or broadly reachable deployments.

TLS certificate verification bypass in @fastify/reply-from versions prior to 12.7.0 allows an on-path attacker to impersonate the configured HTTPS upstream, intercept forwarded credentials and request bodies, and return forged responses. The plugin's built-in HTTPS transports override the secure default by setting rejectUnauthorized to false, so even in the default configuration with an https:// upstream, the proxy fails to validate the upstream's certificate. No public exploit identified at time of analysis. Upgrade to 12.7.0 or apply documented workarounds.

Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.

Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing JobInfoController endpoints that are annotated @PermissionLimit(limit = false). The flaw affects Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 and requires the xxl-job-admin console to be network-reachable with at least one registered executor; exploitation allows creating and starting GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-controlled glueSource. No public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS v4.0 base score of 9.3 and our independent assessment rates it as CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making it a genuine high-priority issue.

Checksum verification bypass in the Go toolchain (cmd/go) versions 1.27.0 before 1.27.2 and before 1.26.9 allows a malicious Go project with a forged golang.org/toolchain go.sum entry, combined with a user-selected attacker-controlled GOMODPROXY, to substitute a tampered toolchain that cmd/go would otherwise reject. Exploitation requires local access and user interaction (CVSS 7.8, AV:L/UI:R) and two attacker-controlled preconditions the victim must opt into: operating inside the crafted project and using the malicious proxy. No public exploit code identified at time of analysis, and EPSS is 0.13% (2nd percentile), indicating low predicted exploitation likelihood.

Missing authentication in TVU Networks Receiver/Transceiver firmware before 7.9 exposes the device web-management REST API on TCP port 8288, letting remote unauthenticated attackers read sensitive device information and modify configuration-including rewriting DNS via /Setting3/API/API/v1/LocalNetwork/DNS to enable man-in-the-middle attacks on outbound TVU cloud connections. The issue is scored CVSS 9.3 (v4.0) and independently assessed as AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:N under CVSS 3.1, with practical impact limited mainly by whether port 8288 is reachable from an untrusted network. No public exploit was identified at time of analysis.

Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.

Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds low-privilege local access on the appliance to recover the root password through the pkcrypto passkey component and thereby obtain full root control, because that component combines weak cryptographic protection with a hard-coded recovery key (CWE-798). The exposure is confined to a local attack path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no network or unauthenticated remote vector exists and the attacker must first establish a foothold on the appliance - realistically an insider or someone who has already compromised the host by other means. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable while assigning total technical impact, and EPSS is 0.11% (1st percentile), so this is a serious but not urgent technical issue.

Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to push and execute arbitrary container images, which in turn grants control over the managed edge clusters that component orchestrates. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for the base case and was independently assessed with scope-changed impact (S:C), reflecting that compromise of the controller extends to the clusters it manages; no credentials, privileges, or user interaction are required against a reachable instance. No public exploit code has been identified at the time of analysis and the issue has not been confirmed as actively exploited (CISA KEV), so the practical risk is driven by network exposure of the edge-controller interface rather than by an observed campaign; a vendor patch is available from IBM.

Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). Exploit path is reachable against default configurations with no feature flag or non-default setting required, but it is not anonymously exploitable - a valid Mistral API token is the single prerequisite. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch availability is not confirmed in the provided data.

Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.

Authentication bypass in Jacamar CI before v0.30.0 allows authenticated CI users to generate arbitrary account names and impersonate other service accounts. The flaw (CWE-290) requires valid low-privilege CI credentials and a runner configured for service-account provisioning; no public exploit has been identified at time of analysis, and signals are mixed, pointing to a moderate rather than urgent priority. A vendor fix is available in v0.30.0.

Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.

Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.

Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows a remote authenticated attacker to have forged or tampered cryptographic signatures accepted by the gateway, defeating the trust checks those signatures are meant to enforce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1), the attacker must already hold valid low-privilege credentials and have network reachability to the gateway, but no user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability effect. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the primary limiting factor is the authentication prerequisite, which excludes fully unauthenticated external attackers.

Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain administrative access to affected appliances by submitting a blank password that the LDAP authentication logic fails to reject. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; exploitation requires only that LDAP be configured for administrative/management authentication and that the authentication interface be network-reachable. At time of analysis there is no public exploit identified, but IBM has published a vendor fix, and the combination of network-only attack surface, no authentication prerequisite, and full confidentiality/integrity/availability impact warrants emergency-level prioritization in any environment using LDAP-backed management logins.

Authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers forge JSON Web Signatures and present themselves as a trusted, already-verified identity on gateways that use JWS/JWT signature verification for access control. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) exploitation requires no credentials or user interaction and the impact is integrity-only, meaning the payoff is forged trust and unauthorized access rather than direct data disclosure. No public exploit identified at time of analysis, EPSS is low at 0.20% (9th percentile), and the CISA SSVC assessment records exploitation as none with automation not feasible, so this is a genuine but moderate-priority issue rather than a top-tier emergency; vendor patches are nonetheless available.

Security restriction bypass in IBM DataPower Gateway leaves the appliance's authorization logic exploitable by unauthenticated remote attackers, allowing them to reach functionality or data that should have required elevated privileges. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the attack is network-reachable with no credentials and no user interaction, but the high attack-complexity component means some condition outside the attacker's control - such as a particular request sequence, timing, or policy/configuration state - must be satisfied first, and the gateway service must be network-reachable at all. IBM's own PSIRT reported the issue and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is scored high for confidentiality and integrity with no availability impact, so the practical risk is unauthorized read/modification of gateway-mediated data or configuration rather than denial of service.

Authorization bypass in OctoCloud 1.12.06 lets an authenticated low-privilege user access functionality and data they should not be permitted to reach, because the application trusts a user-supplied key when making access-control decisions. Successful exploitation allows high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though the attacker must already hold a valid low-privilege account - this is not a remote-unauthenticated flaw. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied; the vulnerable endpoint and parameter are not disclosed in the available TR-CERT advisory. Only the 1.12.06 release line up to (but not including) 1.12.07 is affected.