Authentication Bypass

A critical authentication bypass and path traversal vulnerability in PipesHub AI platform allows unauthenticated remote attackers to upload files with directory traversal sequences, enabling arbitrary file writes anywhere the service account has permissions. This vulnerability affects PipesHub versions prior to 0.1.0-beta and has a publicly available proof-of-concept exploit, making it an immediate priority for organizations using this enterprise search and workflow automation platform. With a CVSS score of 9.8 and the ability to plant malicious code or overwrite critical files, this represents a severe risk to affected systems.

Insufficiently Protected Credentials in Adobe ColdFusion (versions 2025.4, 2023.16, and 2021.22 and earlier) enables unauthenticated remote attackers to gain limited unauthorized write access by exploiting improperly stored or transmitted credentials. The CVSS vector confirms network-accessible, zero-complexity exploitation with no privileges or user interaction required, producing limited integrity impact. Tagged as an Authentication Bypass vector, this vulnerability is distinct from a simple credential disclosure - it permits write operations, making it a meaningful integrity risk despite the moderate CVSS score. No public exploit or CISA KEV listing has been identified at time of analysis.

Improper verification of cryptographic signatures in Adobe Acrobat Reader versions up to 24.001.30264, 20.005.30803, and 25.001.20982 allows local attackers to bypass cryptographic protections and gain limited unauthorized write access to PDF documents. The vulnerability requires user interaction with a malicious or crafted PDF containing an improperly signed element. With a CVSS score of 3.3 and local attack vector, this represents a low-severity security feature bypass affecting document integrity verification.

Improper verification of cryptographic signatures in Adobe Acrobat Reader and Acrobat DC versions up to 24.001.30273, 25.001.20982, and 20.005.30803 allows local attackers to bypass security features and gain limited unauthorized write access to PDF documents. Exploitation requires user interaction with a malicious or specially crafted cryptographic signature embedded in a PDF file. No active exploitation has been confirmed at the time of analysis.

Broken access control in OpenSIS 9.2 and earlier lets an authenticated low-privilege user (e.g. a student account) issue unauthorized database writes against other users' records via Student.php, enabling horizontal privilege escalation and tampering with data they should not control. Publicly available exploit code exists for this issue, though it is not listed in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no confirmed widespread exploitation yet.

Spoofing via UI misrepresentation in Microsoft Exchange Server 2016 and Exchange Server Subscription Edition allows unauthenticated network attackers to falsify critical sender or authentication information as rendered by the Exchange interface. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an attacker to craft messages or interactions that Exchange presents deceptively, undermining trust signals recipients rely upon to distinguish legitimate from malicious communications. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the PR:N/AC:L vector means exploitation requires no credentials and minimal attacker sophistication.

Local code execution in Microsoft Office (365 Apps, Office 2016/2019, Office LTSC 2021, and Office for Android/macOS) stems from a type confusion flaw (CWE-843) that lets an attacker run arbitrary code in the context of the current user. Despite PR:N/UI:N in the CVSS vector, the AV:L attack vector means the attacker must deliver a malicious document to be opened on the target host. No public exploit has been identified at time of analysis and the CVE is not on the CISA KEV list.

Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers to circumvent FortiCloud SSO login by sending a crafted SAML response message. The flaw stems from improper cryptographic signature verification (CWE-347), enabling forgery of authentication assertions. No public exploit identified at time of analysis, EPSS sits at 0.26% (50th percentile), and the issue is not currently listed in CISA KEV, though Fortinet products have historically been high-value targets.

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Missing authorization in Fluent Booking WordPress plugin through version 1.9.11 allows authenticated low-privileged users to modify data without proper access controls. This integrity-only flaw can lead to unauthorized changes in booking information on affected sites.

Authorization bypass through user-controlled key in ThimPress Thim Elementor Kit plugin up to version 1.3.3 allows authenticated attackers to modify data via insecure direct object references. The vulnerability has a CVSS base score of 4.3, a low EPSS exploitation probability (0.07%), and no known public exploit or active exploitation.

Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact. The flaw has a CVSS score of 4.3, very low exploitation probability (EPSS 0.05%), and no known active exploitation or public exploit code at time of analysis.

Unauthenticated modification of invoice data in the WooCommerce PDF Invoices & Packing Slips plugin version 4.9.1 and below allows authenticated low-privilege users (e.g., Shop Managers) to alter invoice or packing slip contents without proper authorization. This missing authorization vulnerability stems from a broken access control check, leading to integrity compromise of PDF documents. No exploitation in the wild or public proof-of-concept are known, and EPSS indicates very low likelihood (0.05%).

The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls. Exploitation requires user interaction and can lead to unauthorized modification of plugin settings or limited information disclosure. Publicly available exploit code exists, but the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.

Permission bypass in Wbcom Designs lock-my-bp WordPress plugin through 2.1.1 allows unauthenticated attackers to modify plugin settings or data due to missing authorization checks. This vulnerability, classified as CWE-862 Missing Authorization, enables unauthorized integrity impact with no confidentiality or availability consequences. The low EPSS score (0.05%) indicates limited exploitation likelihood, and no active exploitation or public exploit code has been reported.

Missing authorization in the TrueBooker WordPress plugin allows unauthenticated attackers to remotely modify appointment booking data. The vulnerability affects versions up to and including 1.1.0 and is classified as CWE-862. No active exploitation or public exploit is known, and EPSS estimates a very low exploitation probability (0.05%).

Unauthorized data modification in the Constant Contact + WooCommerce WordPress plugin through version 2.4.1 allows unauthenticated attackers to alter integration settings, potentially disrupting email marketing synchronisation. No public exploit code or active exploitation reported, and EPSS indicates very low exploitation probability.

Unauthorized data modification in the WP Email Capture plugin for WordPress up to version 3.12.4 allows unauthenticated attackers to alter email capture settings or data through missing authorization checks. The vulnerability has a CVSS base score of 5.3 with low integrity impact and no confidentiality or availability impact. No active exploitation or public proof-of-concept has been identified, and the vulnerability is considered low risk.

Unauthenticated integrity impact in Easy Form Builder plugin up to 3.8.20 allows remote attackers to modify form settings or data due to missing authorization checks. The vulnerability, classified as CWE-862 (Missing Authorization), poses a medium severity risk (CVSS 5.3) with low integrity impact. No active exploitation or public exploit code has been identified at this time.

Unauthenticated access to a restricted endpoint in the Sitewide Notice WP WordPress plugin (versions up to 2.4.1) allows attackers to exploit a missing authorization check, resulting in low-impact availability disruption. The vulnerability requires no credentials or user interaction, but the impact is limited to minor service degradation (e.g., toggling notice state). No public exploit code or active exploitation has been identified; EPSS indicates very low exploitation probability.

Missing authorization checks in wpdevart Booking Calendar WordPress plugin (versions ≤ 3.2.30) allow unauthenticated remote attackers to modify appointment booking data, resulting in low integrity impact. The vulnerability has a CVSS base score of 5.3, EPSS score 0.05% (16th percentile), and no known active exploitation or public exploit code.

WPForms Google Sheet Connector plugin through version 4.0.0 allows unauthenticated remote attackers to modify data by exploiting missing authorization checks on access control mechanisms. The vulnerability enables unauthorized manipulation of form submissions and Google Sheet integrations without proper permission validation, affecting WordPress installations using this plugin.

Missing authorization in the Woffice Core WordPress plugin ≤5.4.30 allows unauthenticated remote attackers to cause limited denial-of-service (availability impact) by exploiting incorrectly configured access control. No confidentiality or integrity impact has been identified. EPSS indicates very low exploitation probability (0.05%) and no active exploitation or public exploit code is known.

Missing authorization in Post SMTP WordPress plugin (≤3.6.1) allows unauthenticated remote attackers to perform restricted administrative actions due to improperly enforced access control on one or more plugin endpoints. Reported by Patchstack and tracked as CWE-862, the flaw permits integrity-affecting operations without requiring any authentication or user interaction. No public exploit code exists and EPSS sits at 0.05% (16th percentile), indicating low observed exploitation interest at time of analysis.

Incorrectly configured access control in WebCodingPlace Image Caption Hover Pro allows authenticated attackers with low privileges to modify plugin data and disrupt service. The vulnerability affects all plugin versions prior to 20.0 and requires only a low-privilege account on the WordPress site. Exploitation probability is very low (EPSS 0.05%) and no active attacks are reported.

Privilege escalation through missing authorization in the WordPress Debug Log Viewer plugin (≤2.0.3) allows authenticated low-privilege users to view and modify debug logs, exposing sensitive data such as database credentials or error details. No active exploitation or public PoC is currently known, and the EPSS score is extremely low (0.03%).

Broken access control in the Listdom WordPress plugin up to version 5.0.1 allows authenticated low-privileged attackers to modify data and potentially disrupt service, as missing authorization checks can be exploited without user interaction. No active exploitation or public exploit has been reported at the time of analysis, and EPSS indicates a very low probability (0.05%) of exploitation.

Low-privilege WordPress users can modify booking data and disrupt scheduling in vcita Meeting Scheduler plugin versions up to 4.5.5 due to missing authorization checks. Exploitation requires an authenticated subscriber-level account but has no user interaction, allowing unauthorized integrity and availability impact. No active exploitation or public exploit code has been identified.

Missing authorization in WP Delicious plugin versions up to 1.9.1 enables authenticated attackers with low privileges (e.g., subscriber) to modify data with high integrity impact. This WordPress plugin vulnerability (CWE-862) has a CVSS base score of 6.5, no confidentiality impact, and requires no user interaction. At this time, no public exploit code or active exploitation has been reported.

Unauthorized data access in the cf7-salesforce WordPress plugin (Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) up to version 1.4.6 allows low-privileged authenticated users to view sensitive information. The missing authorization vulnerability enables attackers with subscriber-level access to bypass access control security levels and access data they should not see. No active exploitation or public exploit has been identified, and the EPSS probability is very low.

Missing authorization in the Trinity Audio WordPress plugin up to version 5.23.3 allows authenticated attackers with low privileges to modify plugin data without the required capabilities, leading to potential integrity issues on affected sites. The vulnerability has a medium CVSS score of 4.3 and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public exploit code at this time.

Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks. The vulnerability, rated Medium (CVSS 4.3), requires a valid user account but no other preconditions; it has a low EPSS score (0.07%) and is not known to be actively exploited.

Missing authorization in the Powerlift theme for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized modifications to theme data. The vulnerability affects all versions prior to 3.2.1 and requires only a valid WordPress user account to exploit. No active exploitation or public exploit code has been identified, and the EPSS score suggests low real-world exploitation probability.

Insufficient access controls in Webba Booking plugin for WordPress (versions up to 6.2.1) allow authenticated attackers with low privileges to modify booking data. EPSS score is low, and no active exploitation is reported.

Missing authorization in the WooCommerce Thank You Page Customizer plugin (versions <= 1.1.8) allows authenticated attackers with low privileges to view thank-you page customization data that should be restricted to administrators. The vulnerability, categorized as CWE-862, has a CVSS score of 4.3 (medium) and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public proof-of-concept code.

Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control. No public exploit or active exploitation has been reported; EPSS probability is very low (0.05%).

An authenticated low-privilege user on WordPress can exploit missing authorization checks in Elastic Email Sender plugin up to version 1.2.20 to cause availability disruption, such as disabling email sending functionality. This vulnerability, reported by Patchstack, carries a medium CVSS 4.3 but extremely low EPSS probability of exploitation, and no evidence of active exploitation exists.

Information disclosure in the My Tickets WordPress plugin through 2.1.0 allows authenticated attackers with low privileges to access sensitive data via a missing authorization check. The vulnerability has a CVSS base score of 4.3, low EPSS exploitation probability (0.05%), and is not listed in CISA KEV nor associated with public exploit code.

Missing authorization in the Admin and Site Enhancements (ASE) WordPress plugin up to version 8.0.8 allows authenticated high-privilege attackers to make low-impact modifications without proper access controls. With a CVSS score of 2.7, EPSS 0.07%, and no known active exploitation or public exploit, the risk is low for most environments.

Missing authorization in the Photo Block WordPress plugin allows authenticated users with high privileges (administrator) to exploit improperly configured access control to modify data they should not have access to, resulting in a low integrity impact. The vulnerability affects all plugin versions up to and including 1.5.1, with no confidentiality or availability compromise. No active exploitation or public exploit code is known at the time of analysis, and EPSS assigns a minimal exploitation probability of 0.07%.

Happy Addons for Elementor through version 3.20.3 allows authenticated users to access functionality they should not have permission to use due to missing authorization checks on API endpoints or admin functions. The vulnerability requires valid user authentication and results in information disclosure, with a CVSS score of 4.3 and an extremely low EPSS exploitation probability of 0.04%, suggesting minimal real-world attack incentive despite the access control flaw.

Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.

Media Library Assistant WordPress plugin through version 3.29 allows authenticated users to bypass authorization controls and access or modify content they should not have permission to reach via user-controlled keys in access control mechanisms. The vulnerability requires an authenticated user with limited privileges (PR:L) and affects confidentiality and integrity of stored media library data, though with relatively low exploitation probability (EPSS 0.04%) and no confirmed active exploitation at time of analysis.

Unauthorized information disclosure in the Yandex.Metrica WordPress plugin (versions up to 1.2.2) allows unauthenticated attackers to access sensitive data via missing authorization checks. No public exploit code or active exploitation has been identified at this time; the EPSS probability of exploitation is very low (0.05%).

Authenticated users can access sensitive contact form data and functionality they should not have permission to view or modify due to missing authorization checks in Contact Form by BestWebSoft plugin versions up to 4.3.6. The vulnerability allows logged-in attackers with low-level privileges to bypass access controls and view contact information or modify form settings with only network access and no additional user interaction required. This is not actively exploited according to available intelligence, though the access control bypass pattern is a common attack vector.

Missing authorization in ExpressTech Systems Quiz And Survey Master WordPress plugin through version 10.3.2 allows unauthenticated remote attackers to read sensitive quiz and survey data by exploiting incorrectly configured access control security levels. The vulnerability is assigned CVSS 5.3 (moderate), affects the plugin across multiple versions, and enables unauthorized information disclosure without requiring authentication or user interaction.

Missing authorization in ListingPro Lead Form plugin for WordPress enables unauthenticated attackers to modify lead data due to improper access controls. Affects versions up to 1.0.7. No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.05% indicates low current exploitation probability, though the remote unauthenticated nature makes the vulnerability easily exploitable if targeted.

A missing authorization check in the Steve Truman Page View Count WordPress plugin (≤ 2.9.0) allows authenticated attackers with low privileges to modify plugin settings without appropriate access controls. This can lead to limited integrity and availability impacts, such as disrupting plugin functionality or altering its behavior. The vulnerability has a low EPSS exploitation probability (0.05%) and is not known to be actively exploited in the wild.

Missing authorization in the Traveler WordPress theme (<=3.2.6) allows unauthenticated attackers to perform actions with low integrity impact, bypassing access controls. No active exploitation or public exploit was identified at time of analysis, and EPSS indicates very low exploitation probability.

Xagio SEO WordPress plugin through version 7.1.0.35 contains a missing authorization vulnerability that allows authenticated users to perform unauthorized actions due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%), affecting authenticated users who can bypass intended access restrictions to modify plugin functionality or settings.

This WordPress plugin (versions ≤4.3.1) misses authorization checks on its order delivery date update functionality, allowing unauthenticated attackers to modify delivery dates and cause limited disruption after tricking a user into clicking a crafted link. The vulnerability requires targeted user interaction but no privileges, and while no active exploitation or public exploit is known at this time, the low EPSS score (0.05%) indicates minimal immediate risk.

Missing authorization in Easy Payment Payment Gateway for PayPal (woo-paypal-gateway) WordPress plugin versions up to 9.0.53 allows unauthenticated remote attackers to access sensitive payment gateway data through improper access control configuration. The vulnerability enables unauthorized information disclosure with low confidentiality impact. EPSS score of 0.04% indicates minimal observed exploitation probability despite network accessibility and no authentication requirement.

Paysera WooCommerce Payment Gateway plugin through version 3.10.0 contains a missing authorization flaw allowing authenticated users with lower privilege levels to access or perform actions intended for higher-privilege roles, resulting in limited information disclosure. The vulnerability stems from incorrectly configured access control checks and has an EPSS score of 0.04% (11th percentile), indicating low real-world exploitation probability despite the CVSS 4.3 rating and authenticated attack vector.

Missing authorization in the WP ERP plugin for WordPress versions up to 1.16.7 allows unauthenticated remote attackers to bypass access controls and modify data. The vulnerability has a CVSS 5.3 rating and only impacts integrity, with no confidentiality or availability loss. No active exploitation or public proof-of-concept is known, and the EPSS score is very low at 0.05%.

Improper access control in Metagauss EventPrime (WordPress event calendar plugin) up to version 4.2.4.1 allows authenticated, low-privileged users (e.g., subscriber) to modify limited event data without proper authorization checks. The vulnerability carries a medium CVSS 4.3 severity, with no confidentiality or availability impact, and an EPSS score of 0.05% indicating a very low exploitation probability. No public exploit or active exploitation (CISA KEV) has been observed.

Missing authorization in themezaa Litho Addons for WordPress (versions through 3.5) allows authenticated users to bypass access controls and gain unauthorized read/write access to sensitive data. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before exposing functionality. With an EPSS score of 0.04% and CVSS 5.4, exploitation requires valid authentication but no advanced attack complexity; this represents a moderate privilege escalation risk for multi-user WordPress installations.

Missing authorization controls in the Notification for Telegram WordPress plugin through version 3.5 allow authenticated users to modify notification settings they should not have access to, resulting in limited integrity impact. The vulnerability requires valid user credentials (PR:L in CVSS vector) and affects the plugin's access control enforcement rather than authentication bypass. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a low-probability real-world risk despite the authentication bypass tag.

Missing authorization in Eupago Gateway For Woocommerce allows unauthenticated remote attackers to modify data via incorrectly configured access control, affecting versions up to 4.7.1. The vulnerability enables integrity compromise without requiring authentication or user interaction, though with low attack complexity. EPSS scoring of 0.04% indicates minimal real-world exploitation probability despite moderate CVSS severity.

Broken access control in the Gravitec.net Web Push Notifications WordPress plugin versions 2.9.17 and earlier allows authenticated users to modify push notification settings and content without proper authorization checks, enabling privilege escalation or manipulation of notifications intended for administrator-only configuration. The vulnerability requires valid WordPress user credentials but does not enforce role-based access controls on sensitive endpoints, granting low-privileged users unintended modification capabilities.

Ergonet Cache plugin versions up to 1.0.13 allows authenticated users to bypass access control checks and modify unauthorized data due to missing authorization validation. The vulnerability requires user authentication (PR:L) but has low real-world risk per EPSS (0.04%), though it can lead to unauthorized content modification in affected WordPress installations.

Missing authorization controls in Mario Peshev WP-CRM System plugin up to version 3.4.6 allow unauthenticated remote attackers to modify data through incorrectly configured access control security levels. The CVSS 5.3 score reflects low integrity impact with no confidentiality or availability consequences, but the vulnerability exposes the plugin to unauthorized data manipulation attacks without authentication.

Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.07%).

Missing access control in ConveyThis WordPress plugin through version 269.2 allows authenticated users with low-level privileges to execute unauthorized actions with high confidentiality, integrity, and availability impact. The vulnerability stems from improper enforcement of authorization checks (CWE-862), enabling privilege escalation by exploiting misconfigured access control security levels. No public exploit identified at time of analysis, with EPSS score of 0.06% indicating low predicted exploitation probability.

Unauthorized modification of plugin settings in Virtuaria PagSeguro for WooCommerce up to version 3.6.3 allows unauthenticated, remote attackers to alter sensitive data such as payment gateway configurations. This missing authorization vulnerability (CWE-862) has a low integrity impact with no confidentiality or availability impact. No active exploitation or public exploit code has been identified at time of analysis, and EPSS indicates a low probability of exploitation.

Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.

Bertha AI WordPress plugin through version 1.13 allows unauthenticated attackers to modify content via incorrectly configured access control, enabling unauthorized changes to website data without authentication. The vulnerability stems from missing authorization checks on sensitive operations, classified as CWE-862 (Missing Authorization). While CVSS scores 5.3 (medium severity), EPSS exploitation probability is minimal at 0.04%, indicating low real-world attack likelihood despite the straightforward attack vector.

Missing authorization vulnerability in Actionwear Products Sync plugin for WordPress up to 2.3.3 allows authenticated attackers with low privileges to disrupt product synchronization operations. The flaw stems from improperly configured access control levels, leading to availability impact. No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.

Unauthenticated information disclosure in the Hype WordPress plugin (versions <=1.0.5) arises from a missing authorization check, allowing remote attackers to access restricted data. No active exploitation or public exploit code is reported, and EPSS estimates a very low exploitation likelihood (0.05%), making this a low-priority issue for most organizations unless the exposed information is highly sensitive.

Same-origin policy bypass in Firefox and Thunderbird request handling allows unauthenticated remote attackers to access sensitive information from cross-origin resources with low attack complexity and no user interaction required. The vulnerability affects Firefox versions below 146, Firefox ESR below 115.31 and 140.6, Thunderbird below 146, and Thunderbird ESR below 140.6. No public exploit code has been identified at time of analysis, and the EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.

Downloads Panel in Mozilla Firefox and Thunderbird allows remote spoofing attacks enabling integrity compromise without authentication. Affects Firefox <146, Thunderbird <146, Firefox ESR <140.7, and Thunderbird ESR <140.7. The authentication bypass flaw (CWE-290) permits network-based attackers to manipulate download information displayed to users with low attack complexity and no user interaction required. Despite CVSS 7.5 (High), EPSS score of 0.02% (3rd percentile) indicates minimal real-world exploitation likelihood. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis.

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

A remote code execution vulnerability (CVSS 2.7) that allows a privileged user. Remediation should follow standard vulnerability management procedures.

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.

Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.

Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.

Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.

Unrestricted file upload in Campcodes Retro Basketball Shoes Online Store 1.0 allows authenticated administrators to upload malicious files via the product_image parameter of /admin/admin_running.php. This can be exploited for remote code execution, and a public exploit is available. EPSS indicates very low exploitation probability (0.06%), and no active exploitation has been confirmed.

Local privilege-level attackers can trigger a use-after-free in the Linux kernel's network bridge (net/bridge) MST implementation when a bridge port is deleted concurrently with FDB learning. The flaw stems from Multiple Spanning Tree (MST) mode bypassing the port's disabled state check, allowing FDB entries to be learned while a port is being torn down. EPSS is low (0.04%, 11th percentile) and there is no public exploit identified at time of analysis; the issue was found by syzbot fuzzing rather than in-the-wild exploitation.

Unrestricted file upload via the Web Administration Module of Verysync (微力同步) up to version 2.21.3 allows a low-privileged remote attacker to upload arbitrary files to the server through a specific API endpoint. The affected endpoint `/rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false` lacks adequate access control enforcement, enabling file placement on the target system without proper authorization validation. A public proof-of-concept exploit has been published; no vendor patch or response has been confirmed as of time of analysis.