Authentication Bypass

Web origin policy bypass in Google Chrome's Navigation component on iOS allows a remote, unauthenticated attacker to escape intended origin boundaries and reach a privileged page when a victim opens a crafted HTML page. Exploitation is constrained by two factors: the mandatory user interaction (CVSS UI:R - the victim must actively load the malicious page) and the narrow platform scope, since only the iOS build of Chrome is affected rather than Chrome on other operating systems. Risk signals are modest - EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - and Google has shipped a fix, so this is a moderate-priority issue rather than an urgent one.

System access restriction bypass in Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to break out of the browser's security boundary through the FullScreen component, but only after having already compromised the Chrome renderer process and only with successful social engineering to make the victim interact with a crafted HTML page. Because it is a chain component rather than a standalone bug, exploitation requires a pre-existing renderer foothold plus mandatory user interaction (UI:R) and carries high attack complexity (AC:H), so it is not exploitable against a fully patched default browser on its own. No KEV listing and no publicly available exploit code have been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), consistent with the conditional nature of the flaw despite the 8.3 CVSS base score and a Chromium security severity rating of Medium.

Google Chrome builds prior to 155.0.8059.39 contain a missing authorization check in the Autofill component that allows a remote attacker to read sensitive information in the browser's stored autofill data. Exploitation is not silent: it requires the victim to be socially engineered into opening an attacker-crafted HTML page (CVSS UI:R, PR:N), and the SSVC assessment records Exploitation=none and Automatable=no, meaning this cannot be triggered at scale or without user action. Our independent assessment rates the impact as confidentiality-only (C:H/I:N/A:N), so real-world risk is MODERATE and meaningfully lower than the headline CVSS 8.8 suggests; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though a vendor patch is available.

Incorrect authorization in the Search component of Google Chrome for Android before 155.0.8059.39 can allow a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page. The vendor-rated Chromium severity is Medium, yet the assessed CVSS is 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the flaw crosses a security boundary (scope changed) with high confidentiality, integrity and availability impact. The risk signals conflict and must be weighed carefully: the impact score is severe, but exploitation requires a click of user interaction, is confined to Android builds (desktop Chrome is unaffected), and no public exploit code or confirmed active exploitation has been identified at the time of analysis. Vendor patches are available.

Sensitive information disclosure in Google Chrome builds prior to 155.0.8059.39 lets an unauthenticated remote attacker obtain data through the browser's Bluetooth handling by convincing a victim to open a crafted HTML page (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N per the independent assessment). The root cause is an incorrect authorization check (CWE-863) in the Web Bluetooth code path, so exploitation is limited to an information leak rather than code execution; the mandatory UI:R requirement means this is not a no-interaction drive-by, and the victim must be running a vulnerable Chrome version that reaches the affected Bluetooth logic. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV entry), although the vendor-rated 8.8 score conflicts with the assessed confidentiality-only vector and should be weighed as a severity signal rather than proof of integrity or availability impact. Vendor-released patch: 155.0.8059.39.

Sandbox escape in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim visits a crafted HTML page and is socially engineered into interacting with the web app installation flow. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 155.0.8059.39; the technical impact is total, but the vendor rates it Medium because exploitation requires a prior renderer compromise, deliberate user interaction (UI:R), and high attack complexity (AC:H) rather than a default-configuration remote hit. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no).

Incorrect authorization in Google Chrome's FileSystem component allows a remote attacker to break out of the browser sandbox and potentially execute arbitrary code at the operating system level on desktop builds prior to 155.0.8059.39. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), no authentication or prior privileges are required, but exploitation is not automatic: the attacker must use social engineering to convince the victim to open a crafted HTML page, which aligns with CISA's SSVC rating of "not automatable" and a technical impact of "total" given the scope change across the sandbox boundary. There is no CISA KEV listing and no public exploit code identified at time of analysis, and a vendor patch is available, so this should be treated as a high-severity, patch-now issue rather than an actively exploited emergency.

Out-of-sandbox code execution in Google Chrome for iOS (versions prior to 155.0.8059.39) stems from a missing authorization check that lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page run arbitrary code outside the browser sandbox (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-862). Exploitation is not possible without user interaction - the victim must navigate to or open attacker-controlled content on a vulnerable iOS Chrome build - and no public exploit code was identified at time of analysis, with no KEV confirmation of active exploitation. The combination of a scope-changing sandbox escape with high confidentiality, integrity, and availability impact makes this a high-priority browser flaw, but the mandatory user interaction and the narrow affected population (only unpatched iOS Chrome builds) keep it short of an emergency-patch situation.

Incorrect authorization (CWE-863) in Google Chrome's SiteIsolation component allows an unauthenticated remote attacker to execute arbitrary code in the browser when a victim loads a crafted HTML page, a flaw Google rates High and that carries a CVSS base score of 9.6. Exploitation is limited by the required user interaction (UI:R) - the victim must visit attacker-controlled or compromised web content on a build older than 155.0.8059.39 - so delivery hinges on drive-by browsing or social engineering rather than unattended compromise, consistent with CISA's SSVC rating of non-automatable. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in Chrome 155.0.8059.39.

Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local attacker to reach a privileged code path and operate at higher integrity than intended, stemming from an improper access control weakness (CWE-284, tagged by the reporter as an authentication bypass). Exploitation is conditional rather than drive-by: the attacker must already hold a local account on the endpoint (AV:L, PR:L) and a separate user interaction step (UI:R) is required to trigger the vulnerable path, so this is a post-foothold escalation scenario with no remote or network-reachable vector. CVSS 3.1 scores it 8.2 with a changed scope and high confidentiality, integrity and availability impact, but no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Devolutions Server versions up to 2026.3.7.0 contain a missing authorization flaw in the global vault that allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. The issue requires valid credentials and a specific view grant, so it is primarily an insider or compromised-account risk rather than unauthenticated remote exploitation. No public exploit code has been identified, EPSS is low (0.17%), and the vendor has released a patch in version 2026.3.8.

Field-level write access control in the MongoDB adapter for Payload CMS (@payloadcms/db-mongodb) can be bypassed by an authenticated user who already holds document-update rights, allowing that user to write values into fields their role was explicitly configured to be unable to modify. Only MongoDB-backed deployments running @payloadcms/db-mongodb before 3.87.0, or canary builds before 4.0.0-canary.20, are affected - the Postgres and SQLite adapters are explicitly unaffected. There is no unauthenticated path and no public exploit identified at time of analysis, but the CVSS 3.1 base score is 7.1 (High, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) because the integrity impact of silently rewriting protected fields is severe once an attacker has any update-capable account.

An authenticated user of Payload CMS can overwrite an existing S3 object owned by a different upload collection when the @payloadcms/storage-s3 plugin is used with client uploads enabled across multiple collections that share a single bucket and leave useCompositePrefixes at its default (false or unset). Because the signed-URL generation path did not bind the target object key to the requesting collection, the attacker's upload silently replaces the victim collection's stored file, bypassing that collection's access controls and any prior file-type/size validation. The flaw yields high integrity impact with no confidentiality loss (CVSS 7.1), requires an authenticated session (PR:L) plus the specific shared-bucket client-upload configuration, and no public exploit code or CISA KEV entry was identified at time of analysis.

Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field configured with the saveToJWT option set to a Payload-reserved claim name (id, collection, email, sid, iat, or exp) can place attacker-influenced values into the authentication token issued at login, allowing spoofing of identity, email, collection, or session claims. Exploitation is gated on a non-default configuration plus attacker control over the aliased field value and a subsequent login, which is why the vendor's CVSS 4.0 score of 9.2 carries Attack Requirements Present (AT:P) and the independent assessment resolves to CVSS:3.1/AV:N/AC:H/PR:L/UI:N (high complexity, authenticated); default installations and collections that only map saveToJWT to non-reserved keys are not reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in version 3.90.0.

Broken tenant-level authorization in @payloadcms/plugin-multi-tenant for Payload CMS before 3.90.0 (and canary releases before 4.0.0-canary.34) lets an authenticated, low-privilege user in the tenant-managed admin users collection add their own account to tenants they are not members of, granting cross-tenant access. The flaw is a missing-authorization condition (CWE-862) in the plugin's default tenants array field access, so an attacker only needs a valid account (PR:L in the CVSS vector) and network reachability to the affected application; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV). Deployments that override the default behavior with secured tenants arrayFieldAccess.create/update functions, or that rely on userHasAccessToAllTenants, are unaffected, and the vendor has released fixes in 3.90.0 and 4.0.0-canary.34.

Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that writes document order changes without evaluating collection or field-level update access control, allowing a caller who can reach that endpoint to alter the sort position of documents in any collection or join field that has the orderable option enabled. The vendor's own fix commit confirms the pre-patch endpoint accepted arbitrary orderableFieldName values and performed the underlying update with access checks bypassed (overrideAccess true), and the post-fix code now rejects unconfigured fields with HTTP 400 and re-runs executeAccess per document, so exploitation depends on the orderable feature being explicitly configured and the achievable impact is confined to the ordering field rather than arbitrary document content. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; authentication requirements are not confirmed from available data, and the input CVSS of 9.8 (triple-High impact) is inconsistent with the source-code evidence, which supports the lower assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Authenticated users who can update an auth collection document in Payload CMS can change the password field on that document even when the collection explicitly defines a field-level access.update restriction intended to deny it, allowing account takeover of the affected user. The flaw affects the npm `payload` package before 3.90.0 and canary releases from 4.0.0-canary.0 through 4.0.0-canary.34, and exploitation is conditional: the deployment must have configured a field-level password update restriction, local auth must be active, and the write must not be a draft save. It is a genuine but conditional integrity flaw rather than an internet-scale emergency - the attacker must already hold valid credentials with document update rights on the target collection, so there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.

Unauthenticated remote code execution in the SPIP Crayons plugin before 3.5.0 allows any remote attacker to take over a SPIP site by reaching crayons_store.php without the secu_ anti-forgery parameter, which causes the authorization dispatcher to select an unconditionally-true handler instead of the legitimate modification check. With authorization bypassed, the attacker can write an arbitrary .html skeleton file, read configuration files that expose the site secret, and forge a signed AJAX context that executes the planted skeleton as PHP under the web-server user. The assessed impact is high across confidentiality, integrity, and availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; vendor-scored 9.3), exploitation requires only that the Crayons plugin be installed and enabled below 3.5.0, and no public exploit code was identified at time of analysis though the flaw is trivially reachable and unauthenticated.

Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access to the duplicate endpoint copy hidden or read/create-restricted values from a source document into a newly created document - potentially exposing secrets such as tokens or credentials stored in access-controlled fields. The issue affects the npm `payload` package from 3.0.0 up to (but not including) 3.90.0, and 4.0.0 canary releases before 4.0.0-canary.34; the `disableDuplicate` setting, which is on by default for auth collections, did not actually block the operation before the fix. Exploitation requires an authenticated account that can reach the duplicate endpoint on a collection containing protected fields, and is a field-level authorization bypass rather than an unauthenticated remote compromise; vendor patches 3.90.0 and 4.0.0-canary.34 are released, and no public exploit code or active exploitation was identified at time of analysis.

Improper access control in the npm package @payloadcms/plugin-mcp (versions 3.61.0 up to but excluding 3.88.0) lets any authenticated user of the configured user collection create, read, update, and delete MCP API keys belonging to other accounts; because an MCP key authenticates as the user it is bound to, an attacker can mint or rebind a key to a higher-privileged account and take it over. The flaw is network-reachable and requires only a low-privileged account (CVSS 4.0 score 8.6 and the independent assessment's CVSS 3.1 vector both carry PR:L with high confidentiality and integrity impact), and it is only exploitable when the application actually exposes the MCP API Key collection - installations that do not use @payloadcms/plugin-mcp are entirely unaffected. The vendor fixed the issue in 3.88.0; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Missing authentication for critical functions in Dell Container Storage Modules' CSI drivers (csi-powerflex, csi-powermax and csi-powerstore) at versions prior to 1.18.0 allows an unauthenticated attacker with adjacent network access to read sensitive information from the Kubernetes storage layer, with no user interaction required (CVSS 7.4, scope-changed, high confidentiality impact only). Affected environments are limited to those that have actually deployed one of these three Dell CSI drivers alongside the corresponding Dell storage array; the vector is AV:A, so the flaw is not reachable from an arbitrary internet host but only from a host on the same logical or physical network segment as the cluster. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is 0.30% (21st percentile), so this is a moderate-priority hardening item rather than an emergency; a vendor patch is available in 1.18.0.

Missing authorization in the PowerMax CSI Driver's csireverseproxy component of Dell Container Storage Modules before 1.18.0 allows unauthenticated attackers with adjacent-network access to perform unauthorized actions, with high confidentiality, integrity, and availability impact in a changed-scope CVSS 9.6 scenario. The flaw is only reachable from the cluster or storage-management network, not the public internet, and requires the PowerMax CSI driver to be deployed and network-exposed. No public exploit was identified at time of analysis and EPSS is low at 0.23% (13th percentile), while a vendor patch is available in 1.18.0.

Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.

Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.

Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.

Mooncake Store master through 0.3.13.post1 performs no authorization check on the EvictDiskReplica and BatchEvictDiskReplica RPCs, so any unauthenticated remote attacker who can reach the master's coro_rpc port can force the deletion of DISK replicas belonging to any object across all tenants. Where a targeted object's only surviving replica lives on disk, the eviction causes permanent, unrecoverable data loss; objects with in-memory or redundant replicas instead suffer availability degradation rather than total loss. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the independently assessed CVSS:3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) reflects high availability impact for any master RPC endpoint that is network-reachable.

Unauthenticated remote attackers can force-delete arbitrary objects in Mooncake Store master through 0.3.13.post1 by sending forged Remove, RemoveByRegex, RemoveAll, or BatchRemove RPCs to the coro_rpc port with the force flag set, bypassing lease checks. This CWE-306 missing-authentication flaw is availability-scoped (CVSS 3.1: C:N/I:L/A:H) and requires only network reachability to the coro_rpc port, enabling cache loss and request failures. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

The Mooncake Store REST service through version 0.3.13.post1 binds to 0.0.0.0 and enforces no authentication on any route, so any host that can reach the service port can read cached KV data (including user prompts), inject or delete objects via /api/put and /api/remove_all, and mount attacker-described segments via /api/mount - all without credentials or user interaction (CVSS:4.0 9.3; independent assessment: CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exposure is the shipped default in affected versions, making risk highest where the listener is reachable from a flat internal network or accidentally exposed to the internet; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). This is a missing-authentication class defect (CWE-306), not a memory-safety or injection bug.

Unauthenticated requests to the WordPress picu plugin (versions up to and including 3.10.1) can reach plugin functionality that is supposed to be protected by an authorization check, letting any remote visitor perform an action the plugin intended to reserve for a privileged or otherwise authorized user. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, with Low confidentiality, integrity and availability impact and S:U) confirms that no credentials, no user interaction and no non-default configuration are required, so any reachable installation is exposed, though the resulting impact is bounded rather than a full site takeover - the specific protected action gated by the missing check is not identified in the available data. There is no public exploit identified at time of analysis and no CISA KEV listing; real-world risk is constrained mainly by the small install base of this specialized client-proofing plugin and by the Low severity of each impact metric.

Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass access controls with low integrity and availability impact, as the plugin fails to enforce authorization (CWE-862). Affected are WordPress sites running the plugin; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, but there is no confidentiality impact and only low integrity/availability impact. No public exploit is identified at time of analysis, and the risk is primarily opportunistic mass scanning against internet-facing instances rather than targeted data theft or code execution.

Broken access control in the WPO365 WordPress plugin through version 44.1 lets an authenticated Subscriber-level account reach data or functionality beyond its assigned role, with the CVSS 3.1 vector indicating high confidentiality impact and a scope change. Exploitation is network-reachable and low-complexity requiring only a low-privilege account, with no user interaction needed; however, sites that disable self-registration or have no untrusted low-tier users substantially limit exposure. The CVE carries a HIGH base score of 8.5, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.

Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.

Broken access control in the Progress Planner WordPress plugin through version 1.10.0 allows any authenticated user holding the low-privileged Subscriber role (or higher) to reach plugin functionality they are not authorized to invoke, yielding high impact to confidentiality, integrity, and availability at a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is network-reachable, requires no user interaction and no elevated privileges beyond a valid low-privilege session, and is classified as CWE-862 (Missing Authorization); risk is greatest on sites that permit open or self-service registration and materially lower where account creation is locked down. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation in CISA KEV; the report originates from Patchstack. Authentication requirements are confirmed from the assessed vector, which carries PR:L, so exploitation is authenticated but does not require administrative access.

Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.

Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.

Unauthenticated remote attackers can access backup data from WordPress sites running the WXD Backup Lite plugin versions 1.0.2 and earlier due to a missing authorization check (CWE-862). The flaw carries a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact only, and exploitation requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low-complexity nature and unauthenticated access make it a significant risk for affected sites.

Unauthenticated broken access control in the WordPress plugin Advanced Posts Listing - Show Post List Easily (versions 1.0.8 and earlier) lets remote attackers retrieve protected post or listing data without logging in or triggering any user interaction. With a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-862 missing authorization, the flaw is a confidentiality-only issue: it exposes data but does not allow modification or denial of service. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the primary limiting factor is deployment-only sites running this specific, low-footprint plugin are affected.

Unauthenticated information disclosure in the WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) allows remote attackers to bypass access controls and read sensitive data from affected WordPress sites. The vulnerability has a CVSS score of 7.5 (CWE-862, missing authorization) and requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the overall risk is assessed as a credible but moderate-priority issue due to its confidentiality-only impact and the need for the specific plugin to be installed.

Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.

Missing authorization in the Wise Chat WordPress plugin (versions 3.4.1 and earlier) lets an authenticated low-privilege user - a Subscriber or any higher role - invoke functionality that lacks a capability check, allowing limited data modification and a significant availability impact on the affected site. The flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), meaning exploitation needs a valid low-privilege account (PR:L) but no victim interaction, so sites that allow open Subscriber self-registration are the realistic attack surface; sites with registration disabled and no untrusted low-privilege users are far less exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the low attack complexity and broad WordPress install base make timely patching advisable. The vulnerability was reported through Patchstack by security researcher Marcin.

Authenticated Subscriber-level attackers can exploit missing authorization checks in ECPay Ecommerce for WooCommerce versions up to 1.1.2606090 to perform actions that may alter store integrity or cause a high availability impact. The flaw requires only a low-privileged account, which is readily available on sites with open registration, but confidentiality is not affected. No public exploit code has been identified, and the vulnerability is not known to be actively exploited.

Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.

Improper authentication in the OAuth token endpoint of Cloud Foundry UAA (CWE-287) enables an authenticated remote attacker to exchange a low-privileged user access token for a fully-privileged client_credentials token, bypassing the need for the client secret. The attacker must possess a valid user token for an OAuth client that is configured to support both a public authorization_code+PKCE flow and the client_credentials grant on the same client_id, a non-default combination; the resulting client token carries the client's full authorities (e.g., clients.write), allowing creation of arbitrary OAuth clients. No public exploit code has been identified at time of analysis, and exploitation requires authenticated user access, with impact scaling to the authorities assigned to the affected client.

Extraction of hardcoded credentials and cryptographic keys from the Schmooze dating mobile application lets unauthenticated remote attackers bypass authentication and act as legitimate clients against the vendor's backend and cloud services, with the CPE entry indicating no version is excluded from the flaw. Because the secrets ship inside a publicly distributed client package, any party who obtains the app and decompiles it can recover them without privileges, user interaction, or special server-side conditions (CVSS 4.0 base 9.3, PR:N/UI:N), yielding high confidentiality impact on the client and high confidentiality plus integrity impact on downstream backend/cloud systems. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV, but the low barrier to reproduction and the structural nature of CWE-321 keep the practical risk high; the independent assessment notes that impact is bounded to the resources those specific embedded secrets authorize, and that key rotation plus app re-release invalidates previously extracted material.

Unauthenticated attackers who can reach the Murr Elektronik AAS Edge Client (all versions) REST API can read every data set exposed by its GET endpoints and alter Asset Administration Shell submodel data through PATCH requests, because those endpoints were deployed without any authentication (CWE-306). The issue is scored 9.3 under CVSS 4.0 and 9.1 under our CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting trivial network-only reachability, no credential requirement, and high confidentiality and integrity impact; availability is not affected in our assessment. No public exploit code and no CISA KEV listing were identified at time of analysis, so actual risk is driven almost entirely by exposure: high where the Edge Client API sits on an untrusted or flat OT network, substantially lower where it is segmented behind firewalls or confined to isolated industrial networks.

Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.

Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.

Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.

Fluent Affiliate Pro, a WordPress affiliate-management plugin maintained by WP Manage Ninja, fails to enforce authorization checks on certain requests in versions 1.6.4 and earlier, allowing unauthenticated remote attackers to perform actions they should not be permitted to perform (CWE-862). The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning exploitation requires no credentials, no user interaction, and no special configuration, but its impact is confined to integrity - attackers can modify affiliate or plugin data, with no confidentiality or availability impact assessed. No public exploit code has been identified and no CISA KEV entry exists at the time of analysis, so the practical risk is driven mainly by whether a given site runs this specific plugin at a vulnerable version, which limits the real-world attack surface.

Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.

Improperly protected application-authorization flow in Joplin Server (the self-hosted sync backend for the Joplin note-taking client) before 3.7.13 lets an attacker supply their own placeholder application identifier, have a logged-in victim approve it on the consent page, and then redeem that identifier for a durable application ID and password that yields a victim session with full read and write access to synchronized notebooks and notes. The CVSS vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A) rates it 8.5 because no attacker credentials are required, though success still depends on a victim who is already authenticated actively approving the consent step, making social engineering or a cross-site request against an authenticated session the practical path rather than silent compromise. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is addressed by upgrading to 3.7.13.

Authenticated workspace members can tamper with another application's MCP server configuration in Dify versions prior to 1.16.0 by sending a PUT request to /console/api/apps/<app_id>/server with an arbitrary server ID, allowing them to disable or redirect the targeted app's MCP integration. The flaw is a cross-tenant/IDOR access-control gap (CWE-639) rated CVSS 7.1 (PR:L, I:H, A:L) that matters most in multi-tenant or multi-team Dify installations; no public exploit identified at time of analysis.

Remote unauthenticated attackers can make ViewSonic vCast fetch and install an attacker-supplied APK by abusing the vCast APK delivery mechanism's unauthenticated download endpoint to point the device at a malicious APK URL. Affected versions are vCast v0.0.0 through v3.2.715 inclusive on ViewSonic ViewBoard devices; the endpoint is network-reachable with no privileges and no user interaction, but the resulting installation is unprivileged, so the planted app runs as a normal application rather than with system/root rights. The supplied CVSS 3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), while our independent assessment treats the practical impact as C:N/I:L/A:N because the outcome is unprivileged app installation; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.

An authenticated user holding openSIS Classic 9.3's built-in teacher role can reset the password of any other staff account by supplying an arbitrary staff_id value to the School Information update path, giving a low-privileged operator full control of higher-privileged accounts. The flaw is a classic user-controlled key (CWE-639) authorization bypass: the application trusts the staff_id request parameter when populating the session's staff context and then uses that context to authorize a password change without confirming it matches the caller's own user_id. Only a valid teacher-level session is required; no admin rights, user interaction, or non-default configuration is needed, and severity is rated 9.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality and integrity impact plus scope change), consistent with an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor reports a patch and the affected code path is trivially reachable for any authenticated teacher.

Incorrect authorization in the Camunda 7 Admin web application (7.24.0 through 7.24.14) lets an unauthenticated remote attacker reach the first-run setup user-create endpoint and create a new administrator account, enabling account takeover and, via admin-level process deployment or scripting, code execution as the workflow engine's service user (CWE-863, CVSS 9.2). Exploitation is not default-configuration remote takeover: the setup endpoint only becomes reachable when the camunda-admin group contains zero direct members while the deployment is nonetheless fully administered through configured authorizations, which is why the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N and the CVSS 4.0 vector carries AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 7.24.15.

Authenticated remote users of Langflow can defeat the localhost-only restriction on the MCP configuration install endpoint (POST /api/v1/mcp/project/{project_id}/install) by sending a forged 'X-Forwarded-For: 127.0.0.1' header, causing the server to treat the request as local and allowing the attacker to write or overwrite an MCP client configuration file on the host filesystem. The flaw affects Langflow versions 1.5.0 up to but not including 1.10.3 and carries a CVSS v3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), reflecting a high integrity impact and low availability impact but no confidentiality loss. Authentication is mandatory, no user interaction is required, and no public exploit identified at time of analysis; no EPSS data was supplied for this CVE, so risk is driven by the moderate CVSS score and the requirement for a valid session rather than by observed exploitation.

Cross-tenant file disclosure in Langflow 1.6.8 through 1.9.0 allows any authenticated user who can reach a project-scoped MCP connection to read another user's flow-backed artifacts - uploaded documents, structured data, prompts, and other private flow files - by supplying an arbitrary resource URI to the resources/read handler, which forwarded the caller-controlled URI to storage_service.get_file without verifying that the referenced flow belonged to the caller or the current project (CWE-639). The flaw is read-only, so victim files and stored flows are not modified, but confidentiality impact is high on multi-tenant or multi-user instances where other users' files exist to be read; no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV). The vendor fixed the issue in Langflow 1.9.1.

Local privilege escalation in Google Android 17 lets a locally installed, low-privileged application escape its sandbox and obtain system-level privileges by reaching the isSystem() routine in WifiPermissionsUtil.java, which fails to perform the required permission check (CWE-862). The flaw is rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting a changed-scope impact in which a compromised app in the application sandbox compromises the platform itself, with high confidentiality, integrity and availability effects and no user interaction required. An attacker must already have achieved local code execution on the device (for example through a malicious or trojanized app), and only Android 17 is listed as affected, so devices on other releases or on the October 2026 patch level are not exposed; no public exploit identified at time of analysis, and the issue is addressed through the Android Security Bulletin dated 2026-10-01.

Unauthenticated remote attackers can forge Django-signed session cookies, CSRF tokens, and password-reset tokens, and bypass live-service authentication, against Plane installations that shipped with publicly known default secrets. Plane versions prior to 1.4.0 distributed fixed SECRET_KEY (60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5) and LIVE_SERVER_SECRET_KEY (htbqvBJAgpm9bzvf3r4urJer0ENReatceh) values in the deployments/aio/community/ and deployments/cli/community/ manifests, while the top-level setup.sh randomized secrets only for the development Docker Compose path, leaving AIO and CLI community deployments with shared production secrets by default. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) and classified CWE-798; no public exploit identified at time of analysis, although the default key values are published in the vendor repository and are therefore trivially usable by anyone who reads it. Exposure is limited to network-reachable instances deployed via those community manifests whose operators never overrode the secrets; deployments created through the development Compose path, operator-hardened installs with unique secrets, and instances upgraded to 1.4.0 are not exploitable.

Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as existing users by exploiting OAuth email trust in Gitea and self-managed GitLab deployments where email confirmation is disabled. The vulnerability (CWE-287) stems from Plane matching the email returned by the OAuth provider to a local account without verifying provider-side ownership; an attacker can set an OAuth identity's unverified email to the victim's address and authenticate as them without knowing the password, as confirmed by the provided independent assessment. Deployments using GitHub, GitLab.com, or Google OAuth are not affected because those providers return verified emails; no public exploit identified at time of analysis, and the flaw is gated by deployment configuration rather than being universally exploitable.

Missing authorization checks in the WordPress plugin 'Scratch & Win - Giveaways and Contests' (all versions through 3.0.2, vendor Apps Mav) allow an authenticated low-privilege user - for example a subscriber on a site that permits open or self-service registration - to reach plugin functionality that should be gated behind higher-privilege capabilities, resulting in high confidentiality exposure plus limited integrity and availability impact (CVSS 3.1 base 7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Exploitation is network-reachable and requires no user interaction, but it is constrained by the need for a valid low-privileged account, so purely anonymous abuse is not confirmed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released fixed version appears in the available data.

Authenticated low-privilege users can retrieve embedded sensitive data from WordPress sites running the RepairBuddy plugin (versions through 4.1226) due to a missing authorization check. This moderate-severity vulnerability (CVSS 7.1) impacts only confidentiality, requires a valid account with minimal privileges, and has no public exploit code or active exploitation reported.

Improper authorization in Plane before 1.4.0 lets an authenticated workspace Guest hijack file assets from other projects in the same workspace through ProjectBulkAssetEndpoint.post. By supplying valid asset UUIDs from a foreign project and reassigning issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity they control, the attacker causes Plane to treat their project as owner and return a presigned download URL for the hijacked file. The flaw is assessed as CVSS 9.6 (PR:L, scope changed) and is fixed in 1.4.0; no public exploit identified at time of analysis.

An insecure direct object reference (IDOR) in Plane prior to 1.4.0 lets an authenticated member of a project reassign ownership of another user's issue attachment by supplying a pk UUID in the V2 issue-attachment PATCH request. Because the endpoint validates only pk, workspace, and project_id while ignoring the issue_id present in the URL, an attacker with project membership (CVSS PR:L, network vector) can target any attachment still in the PENDING, not-yet-confirmed upload state and set created_by to their own account, thereby taking control of it; confirmed attachments are unaffected, and exploitation also requires knowing the victim's unguessable UUID. The flaw is a genuine but moderate-priority authorization issue (CWE-639) with no public exploit identified at time of analysis, and it is fixed in the vendor's 1.4.0 release.

Plane prior to 1.4.0 allows an authenticated workspace member to bypass project-level authorization and join any project in that workspace, including private or secret projects with network=0, while receiving a full Member role with read and write access. The root cause is CWE-284 improper access control in the GraphQL joinProject mutation, which validated workspace membership but failed to enforce the target project's visibility. Exploitation requires an active authenticated workspace member and a workspace containing private projects, making this an insider or post-account-compromise escalation rather than an unauthenticated exposure; no public exploit identified at time of analysis, and the issue is fixed in 1.4.0.

Authorization bypass in the Plane project-management platform (Makeplane) prior to 1.4.0 lets callers retrieve FileAsset records - issue-description and comment-description attachments - from private or unpublished projects without being a member of the project those assets belong to. Two authenticated workspace-scoped endpoints (WorkspaceFileAssetEndpoint and WorkspaceAssetDownloadEndpoint) resolve assets by workspace only, so any active workspace member who knows an asset UUID can pull files from any project in that workspace, while the public-anchor EntityAssetEndpoint grants AllowAny access and scopes lookups to the anchor's workspace rather than its published entity or project, so an unauthenticated remote caller with a valid published anchor and a valid asset UUID can read assets from unpublished or private projects in that workspace; the CVSS vector (PR:N, no user interaction) reflects that unauthenticated path. Exploitation is constrained by CWE-639-style IDOR prerequisites: asset UUIDs are random and non-enumerable, so the attacker must first leak or otherwise obtain them, and no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is fixed in 1.4.0, and the practical priority is moderate rather than urgent given the UUID-guessing barrier.

Cross-tenant deletion of estimate points in Plane (Makeplane) before 1.4.0 allows any authenticated user holding an administrator or member role in one workspace to permanently destroy an estimate point owned by a different workspace, simply by supplying the victim record's UUID in a URL scoped to the attacker's own workspace. The flaw is a destructive cross-tenant IDOR (CWE-639) rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), requiring only a valid low-privilege account and knowledge of the target's random 128-bit UUID, which must be obtained out-of-band since it is not enumerable through this endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis; the operational risk is moderate-to-high specifically for multi-tenant Plane deployments, while single-tenant installs have no cross-tenant victim.

An authenticated attacker who knows a target workspace slug and project ID can hijack a pending project invitation in Plane versions prior to 1.4.0, because the project invitation list endpoint is readable by any authenticated user and the public join endpoint accepted an invite based only on a submitted email address with no token or identity check. If the outstanding invitation targets an email that has not yet registered, the attacker can register an account with that address without mailbox verification and be added to the target workspace and project, gaining confidentiality and integrity impact across a tenant boundary. The flaw (CWE-863) is rated CVSS 8.2 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N; exploitation requires a low-privilege authenticated session and an outstanding invite for an unregistered address, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Vendor-released patch: 1.4.0.

Insecure direct object reference in Plane's public Spaces asset endpoints (all versions prior to 1.4.0) allows an attacker to read, overwrite, or restore arbitrary FileAsset records belonging to other projects and workspaces by supplying a crafted asset ID. The vulnerable code paths - EntityAssetEndpoint and AssetRestoreEndpoint in plane/space/views/asset.py - resolve a DeployBoard from a public anchor but fetch or mutate FileAsset rows scoped only to that board's workspace, with no membership check and no project_id constraint, even though sibling endpoints in plane/app/views/asset/v2.py had already been hardened for two earlier cross-tenant asset IDORs tracked as CVE-2026-27705 and CVE-2026-46558. Exploitation requires that at least one board be published as a public/shared board so an attacker can obtain a valid DeployBoard public anchor; the input CVSS 3.1 vector rates PR:L (7.1, High), while our independent assessment scores PR:N because the affected endpoints are reachable under the unauthenticated /api/public/ namespace, and this difference should be confirmed in the target deployment. No public exploit code or in-the-wild exploitation has been identified for this issue at time of analysis, and it is not listed in CISA KEV.

Deactivated user accounts in Plane prior to 1.4.0 can still authenticate with existing credentials because the login flow does not reject inactive users and save_user_data() silently sets is_active back to True, reactivating the account without notifying administrators. This is an authenticated (CVSS PR:L) improper access control issue (CWE-284) requiring the attacker to possess valid, un-rotated credentials for an account that was deactivated via is_active=False rather than deleted; impact scales with the account's prior role, up to full workspace control if it was an Admin. No public exploit identified at time of analysis, no CISA KEV listing and no EPSS score were present in the provided intelligence; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 High).

Cross-workspace authorization bypass in Plane (makeplane) releases prior to 1.4.0 lets any authenticated user read, duplicate, modify, or delete file assets and read workspace-view data belonging to workspaces they are not members of. The vulnerable surfaces are DuplicateAssetEndpoint (source FileAsset fetched without workspace scoping), WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint (missing workspace authorization on read/create/update/delete), and WorkspaceViewViewSet.retrieve (missing the authorization decorator its sibling actions apply). Exploitation requires a valid authenticated account but not membership in the victim workspace, so multi-tenant, multi-workspace self-hosted deployments carry the most exposure; no public exploit code has been identified and there is no KEV confirmation of active exploitation. The issue is fixed in version 1.4.0.

Missing workspace authorization in Plane's entity-search API before version 1.4.0 allows any authenticated user who knows a workspace slug to retrieve member display names, UUIDs, avatar URLs, and ProjectMember rows from workspaces they do not belong to. The flaw is a CWE-862 missing authorization issue in SearchEndpoint, which enforced only IsAuthenticated; upgrading to 1.4.0, which adds WorkspaceUserPermission, fully remediates. No public exploit code was identified at time of analysis.

Authenticated cross-workspace access control bypass in Plane (makeplane/plane) before version 1.4.0 lets any user with a valid account in one workspace read and modify estimates, and inject comments into issues, belonging to a completely different workspace. The flaw is a CWE-639 (IDOR/BOLA) issue: the PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ and POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/ handlers resolve estimate_id and issue_id by primary key without re-verifying that those objects belong to the workspace and project named in the URL, even though ProjectEntityPermission validates the caller's membership in the URL-named scope. Exploitation requires authentication and knowledge or enumeration of a foreign object ID, and is confirmed by vendor advisory GHSA-933r-rxg8-f3h2 and fixing PR #9286; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high confidentiality and integrity impact (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca Cart extension (versions 5.0.0 through 6.1.8), because the order-file download endpoint checks only that the 'd' (download token) and 'o' (order token) parameters are non-empty instead of comparing them with the stored download_token and order_token values. Any guest with no account can enumerate sequential numeric order IDs, supply arbitrary non-empty token values, and retrieve files belonging to other customers, making this a high-severity confidentiality breach with no authentication and no user interaction required (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5, C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the issue is a genuine high-priority concern rather than an inflated score, with impact limited only by the practical prerequisite that the store actually offers downloadable goods served through this endpoint and has existing order records to enumerate.

An authentication bypass in the npm packages @insumermodel/mppx-condition-gate (before 3.0.0) and @insumermodel/mppx-token-gate (1.0.0 through 1.0.3) lets unauthenticated remote attackers obtain content that should require payment by simply naming any wallet address that satisfies the configured on-chain condition. The gates trusted the client-supplied credential.source as proof of payer identity instead of verifying wallet control, so since qualifying wallets are public blockchain state, no secret or wallet ownership is needed; cached free-access grants can also be reused for the configured cache lifetime. No public exploit code was identified at time of analysis, and practical risk is bounded by the small deployment footprint of these packages; the vendor-released fixes are @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.

Remote user validation in HPE Integrated Lights-Out (iLO) 7 firmware can be subverted by unauthenticated network attackers, giving them high-impact confidentiality, integrity, and availability effects on the baseboard management controller and, because the CVSS vector carries a scope change (S:C), potentially on the systems that controller manages. The flaw is rated CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack complexity means a successful bypass hinges on specific preconditions, state, or timing rather than one deterministic request, and reachability is limited to networks that can route to the iLO management interface. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so real-world risk concentrates in environments where iLO is exposed beyond a segmented out-of-band management network.

Improper authorization in the boa web server on TOTOLINK A3002MU firmware 1.0.0-B20230403.1455 lets remote, unauthenticated attackers reach protected administrative functionality without a valid session, giving them full control over the device's web management interface (high confidentiality, integrity and availability impact). Publicly available exploit code exists against the authentication-check function sub_40FCFC in /bin/boa, so weaponisation effort is low, although no CISA KEV listing or other confirmation of active exploitation was present in the available intelligence at time of analysis. Exposure is the practical limiter: units with WAN-side management enabled are directly internet-exploitable, whereas units whose admin interface is LAN-only require an on-network attacker or a LAN-side pivot.

Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.

Incorrect access control in Feehi CMS 2.1.1 allows a low-privilege backend administrator who holds the administrator-update permission to overwrite the password of the built-in super administrator account, achieving full super-admin takeover. The server neither protects the built-in super administrator record from modification nor requires the target account's current password during the update flow, so a single crafted backend request is sufficient. This is an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, rated 7.2 High) that requires a pre-existing privileged backend session; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch was identified in the available intelligence.

Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim's external identity provider subject, so that the victim's later, legitimate external login is transparently signed into the attacker-controlled account. Affected deployments are ZITADEL before 3.4.14 and 4.x before 4.16.2 that still run the legacy hosted Login V1 UI with at least one external IdP configured; exploitation also requires the attacker to know a valid IDPConfigID and the victim's ExternalUserID, which tempers the 9.3 CVSS 4.0 rating (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the lack of authentication, low attack complexity, and full account-takeover outcome make this a high-priority patch target.

ZITADEL 4.x before 4.17.1 fails to check an organization's inactive state during Login V2 authentication, allowing users of a deactivated organization to continue signing in, create sessions, and obtain or refresh tokens if they already possess valid credentials, an existing session, or a refresh token. This authenticated access-control bypass primarily impacts offboarding and deprovisioning workflows, as it does not allow an arbitrary external attacker to gain access without prior valid credentials. No public exploit has been identified at time of analysis, and the flaw does not affect active organizations or bypass per-user deactivation.

Account takeover in ZITADEL affects deployments using the hosted Login V1 or V2 UI on versions 3.x before 3.4.14 and 4.x before 4.16.2. Unauthenticated attackers who know a valid login name can enroll an attacker-controlled passkey or other authenticator during an identify-only session, before any primary factor is verified, and then log in as the victim, bypassing passwords and MFA. No public exploit code has been identified at time of analysis, but the vulnerability is rated high risk due to its unauthenticated nature and low complexity.

Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected accounts, including administrator accounts, by reading OTP codes from server-action responses when the 'returnCode' OTP delivery type is enabled and the victim has both OTP-Email and OTP-SMS enrolled. The attack requires prior knowledge of the victim's login name and a non-default deployment configuration; instances using standard out-of-band OTP delivery or users without both factors are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but the complete compromise of confidentiality, integrity, and availability of targeted identities warrants immediate patching.

Unauthenticated remote attackers who know a valid user's login name can enroll attacker-controlled multi-factor authentication factors - including TOTP, OTP-SMS, OTP-Email, and U2F - and overwrite the victim's verified phone number in ZITADEL deployments that expose the legacy hosted Login V1 UI. Affected versions are 3.x before 3.4.15 and 4.x before 4.17.1. The flaw resides in second-factor enrollment and initialization handlers that act on an identify-only session before any primary factor is verified, and it also lets attackers enumerate valid usernames through discrepant error responses. No public exploit code has been identified at time of analysis, but this is a genuine high-priority risk given the low prerequisite (only a login name) and high integrity impact (CVSS 8.8; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:L/I:H/A:N).

Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker who holds user-write permission in one organization to request a passkey or passwordless enrollment code for a user in a different organization on the same multi-tenant instance, then register their own authenticator and seize that account. The flaw is an improper authorization check (CWE-862): the server validates the organization named in the x-zitadel-orgid header instead of the target user's actual organization. Exploitation requires a deployment hosting at least two organizations plus a valid low-privileged user-write role, so single-organization instances and instances already on 3.4.15 or 4.17.1+ are not affected; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.

Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated remote attacker who knows a victim's login name can bind an external identity provider (IdP) identity they control to the victim's account and then sign in as that user, obtaining full control of the account and its data. The root cause is that the account-to-IdP linking flow neither verifies a primary authentication factor nor checks the caller's permission, and it is reachable through two distinct paths named in the advisory - identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. The vendor has published a fix for the 4.x line in 4.17.3, no public exploit code was identified at time of analysis, and this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact because exploitation requires only knowledge of the victim's login name and network reachability.

Improper authentication in AhsayCBS up to version 10.3.2 lets an unauthenticated remote attacker bypass credential verification by manipulating the 'random' parameter processed by the checkSysPwd routine in the API component (com/ahsay/obs/api/ApiStructsAction.java). Exploitation requires only network reachability to the exposed AhsayCBS API/management interface and publicly available exploit code exists, so deployments that leave the console internet-facing or broadly reachable are the most at risk. The assessed impact is limited to partial confidentiality, integrity, and availability effects, and no confirmed active exploitation (CISA KEV) has been reported, making this a moderate-priority issue that is nonetheless straightforward to trigger where the API is exposed.

Information disclosure in LaraDashboard before 1.4.8 allows an authenticated user who holds only the low-privilege settings.view permission to read stored secrets in plaintext by calling GET /api/settings or GET /api/settings/{option_name}, exposing AI provider API keys, mail/SMTP credentials, passwords and tokens. The flaw is an incorrect authorization / masking failure (CWE-863): the settings API policy treats the view permission as sufficient while SettingResource serializes option_value verbatim, so any account granted settings.view sees every configured secret; exposure is conditioned on secrets actually having been saved in settings. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released 1.4.8, which introduces secret masking, keys hidden from the API, and a dedicated update policy.