Authentication Bypass

A security vulnerability in Sentry 25.1.0 (CVSS 4.2). Remediation should follow standard vulnerability management procedures.

CVE-2025-4378 is a critical authentication vulnerability in Ataturk University's ATA-AOF Mobile Application that combines cleartext transmission of sensitive information with hard-coded credentials, allowing unauthenticated attackers over the network to bypass authentication and abuse user accounts. All versions before 20.06.2025 are affected with a perfect CVSS 3.1 score of 10.0, indicating maximum severity across confidentiality, integrity, and availability dimensions.

PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.

A authentication bypass vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm (CVSS 9.3). Critical severity with potential for significant impact on affected systems.

CVE-2025-32977 is a critical unauthenticated backup file upload vulnerability in Quest KACE Systems Management Appliance (SMA) that allows attackers to bypass signature validation and upload malicious backup content, potentially achieving remote code execution with system-wide impact. The vulnerability affects SMA versions 13.0.x through 14.1.x and requires only user interaction (UI:R) but no authentication (PR:N), with a CVSS 9.6 severity rating indicating high exploitability.

CVE-2025-32976 is a security vulnerability (CVSS 8.8) that allows authenticated users. High severity vulnerability requiring prompt remediation.

CVE-2025-27827 is an information disclosure vulnerability in Mitel MiContact Center Business legacy chat component (versions through 10.2.0.3) that allows unauthenticated attackers to access sensitive chat data and session information through improper session handling. An attacker can exploit this to read active chat messages, join chat rooms without authorization, and send messages as legitimate users, requiring only user interaction to succeed. The CVSS 7.1 score reflects high confidentiality impact with limited integrity risk, though real-world exploitability depends on whether this is actively exploited (KEV status unknown from provided data) and patch availability from Mitel.

Improper authorization bypass in Firefox for Android allows remote attackers to skip the security prompt when opening links in external applications. Affected versions prior to 140 enable crafted links to launch external apps without user consent, potentially exposing users to vulnerabilities or privacy leaks within those apps. No active exploitation or public exploit code is known, and the EPSS likelihood is very low.

URL parsing bypass in Firefox and Thunderbird allows attackers to rewrite URLs to youtube.com via an embed tag, potentially bypassing website security checks that restrict embed domains. Affects Firefox < 140, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12. No public exploit identified at time of analysis.

A security vulnerability in Devtools. This vulnerability affects Firefox (CVSS 9.1). Critical severity with potential for significant impact on affected systems.

CVE-2025-3091 is an authentication bypass vulnerability allowing a low-privileged remote attacker to hijack another user's account by possessing only that user's second factor (2FA), completely bypassing password authentication. This affects multi-factor authentication implementations where the second factor can be used independently to establish a session. The vulnerability has a CVSS score of 7.5 (High) with moderate attack complexity, and represents a critical weakness in MFA architecture since attackers need only compromise one authentication factor rather than all factors.

CVE-2025-3090 is a critical authentication bypass vulnerability affecting network devices that exposes a missing authentication requirement for sensitive functions. The vulnerability allows unauthenticated remote attackers to obtain limited sensitive information and trigger denial-of-service conditions without requiring any user interaction or special privileges. If actively exploited (KEV status pending confirmation), this represents an immediate threat to exposed devices as the attack vector is network-based with low complexity.

A command injection vulnerability in Connection Diagnostics page (CVSS 8.8). High severity vulnerability requiring prompt remediation.

A privilege escalation vulnerability (CVSS 9.6) that allows an unauthenticated attacker. Risk factors: public PoC available.

CVE-2025-48466 is a security vulnerability (CVSS 8.1). Risk factors: public PoC available.

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

White-labeled DVRs manufactured by TVT contain an unauthenticated OS command injection in the 'Cross Web Server' HTTP service on ports 81/82. The URI path handling for language extraction fails to sanitize input, enabling remote attackers to execute arbitrary commands on the surveillance DVR.

Authentication bypass via CAPTCHA replay in Novel Plus versions up to 5.1.3 allows remote attackers to circumvent brute-force protections. The flaw in the ajaxLogin function's CATCHA handler permits reuse of valid CAPTCHA tokens, enabling credential guessing attacks. Publicly available exploit code exists, but exploitation is difficult and no active exploitation has been confirmed.

Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.

Improper authentication in 70mai 1S dashcam up to firmware 20250611 allows local network attackers to access video footage and live streams without credentials. A public exploit exists, but exploitation is difficult due to high attack complexity and local network access requirement. No active exploitation in CISA KEV.

A security vulnerability in WhiteBeam 0.2.0 (CVSS 5.7). Remediation should follow standard vulnerability management procedures.

CVE-2025-6547 is an improper input validation vulnerability in the pbkdf2 cryptographic library (versions ≤3.1.2) that allows attackers to spoof cryptographic signatures through inadequate validation mechanisms. This affects any application using vulnerable pbkdf2 versions for password hashing or key derivation, potentially compromising authentication and integrity verification. With a CVSS score of 9.1 and high integrity/signature impact ratings, this vulnerability has significant real-world implications for systems relying on pbkdf2 for security-critical operations.

CVE-2023-47031 is a critical privilege escalation vulnerability in NCR Terminal Handler v1.5.1 that allows unauthenticated remote attackers to gain administrative privileges by crafting malicious POST requests to SOAP API endpoints (grantRolesToUsers, grantRolesToGroups, grantRolesToOrganization). With a CVSS score of 9.8 and attack vector requiring no authentication or user interaction, this vulnerability poses an immediate threat to exposed NCR Terminal Handler installations. The vulnerability has been confirmed with public disclosure and is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

CVE-2024-45347 is a critical authentication bypass vulnerability in Xiaomi Mi Connect Service APP caused by flawed validation logic that allows unauthenticated attackers on the same network segment to gain unauthorized access to victim devices with complete control (confidentiality, integrity, and availability compromise). With a CVSS score of 9.6 and CVSS vector indicating adjacent network access with no privileges or user interaction required, this vulnerability represents a severe risk to Xiaomi device users, particularly in shared network environments (corporate WiFi, home networks, public hotspots).

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.

Unrestricted file upload in ruoyi-ai 2.0.0 allows remote authenticated attackers to upload arbitrary files via the speechToTextTranscriptionsV2/upload endpoint. Public exploit code exists, and a patch is available in version 2.0.1. EPSS score is low (0.15%), indicating limited exploitation likelihood.

Unrestricted file upload in Campcodes Online Recruitment Management System 1.0 allows authenticated attackers to upload arbitrary PHP files via the /admin/ajax.php?action=save_settings endpoint, leading to remote code execution. A public exploit is available, but no active exploitation has been reported (EPSS 0.12%).

CVE-2025-52918 is a security vulnerability (CVSS 5.0). Remediation should follow standard vulnerability management procedures.

CVE-2025-52487 is an authentication bypass vulnerability in DNN (DotNetNuke) versions 7.0.0 through 10.0.0 that allows attackers to circumvent IP-based login filters by crafting specially designed requests or using proxy techniques. An unauthenticated remote attacker can bypass IP whitelist restrictions to attempt logins from unauthorized locations, potentially gaining unauthorized access to administrative accounts. The vulnerability has been patched in version 10.0.1 and carries a CVSS 7.5 score reflecting high integrity impact, though no public exploitation or active KEV listing has been reported at this time.

Allegra project tracking software contains an authentication bypass in the password recovery token generation. Unauthenticated remote attackers can calculate the token expiration date and generate valid password reset tokens, allowing them to reset any user's password including administrators.

CVE-2025-5820 is a critical Bluetooth ERTM (Enhanced Retransmission Mode) channel authentication bypass vulnerability in Sony XAV-AX8500 infotainment systems that allows network-adjacent attackers to completely bypass authentication without any privileges or user interaction. Attackers can achieve high-impact compromise of confidentiality, integrity, and availability through improper channel data initialization in the Bluetooth implementation. The vulnerability has a CVSS 3.1 score of 8.8 (High) and represents a significant risk to vehicles using this aftermarket receiver, though exploitation requires physical proximity and the specific technical conditions of ERTM channel manipulation.

CVE-2025-5476 is an authentication bypass vulnerability in Sony XAV-AX8500 Bluetooth car audio systems caused by improper L2CAP channel isolation in ACL-U links. A network-adjacent attacker can completely bypass authentication without user interaction to gain full control (read, modify, execute) of the device. This is a critical vulnerability affecting in-vehicle infotainment systems with potential safety and privacy implications.

An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template.

CVE-2025-34022 is an unauthenticated path traversal vulnerability in Selea Targa IP OCR-ANPR cameras affecting at least 9 models (iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, Targa 704 ILB). The /common/get_file.php script fails to validate the 'file' parameter, allowing remote attackers to read arbitrary files including system credentials in cleartext. Active exploitation was confirmed by Shadowserver Foundation on 2025-02-02 UTC, indicating this is not theoretical-it is actively weaponized in the wild.

A security vulnerability in all (CVSS 8.7) that allows for cross-site-scripting attack and content security policy bypass. High severity vulnerability requiring prompt remediation.

CVE-2025-44635 is a security vulnerability (CVSS 9.8). Critical severity with potential for significant impact on affected systems.

CVE-2025-52802 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.

A security vulnerability in Missing Authorization vulnerability in Mahmudul (CVSS 6.5). Remediation should follow standard vulnerability management procedures.

Missing authorization in Zapier for WordPress plugin up to version 1.5.2 allows authenticated attackers with low privileges to exploit broken access controls, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).

Missing authorization in Kata Plus WordPress plugin up to version 1.5.3 allows low-privileged attackers to exploit incorrectly configured access controls, leading to limited integrity and availability impact. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).

A remote code execution vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.

Missing authorization in WooCommerce Fortnox Integration plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modifications. The vulnerability affects all versions up to 4.5.5 and has a CVSS score of 5.4 (medium), with no public exploit or active exploitation reported.

Missing authorization in RafflePress Giveaways and Contests plugin for WordPress allows unauthenticated attackers to access functionality that should be restricted to authorized users. This affects versions through 1.12.17 and can lead to unauthorized modification of giveaway settings or data. No public exploit or active exploitation has been identified.

A security vulnerability in osama (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.

CVE-2025-49995 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.

Missing authorization in Cookie-Script.com WordPress plugin up to version 1.2.1 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying plugin settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).

A security vulnerability in Missing Authorization vulnerability in tggfref WP-Recall (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.

A security vulnerability in Missing Authorization vulnerability in contentstudio ContentStudio (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.

Missing authorization in App Builder WordPress plugin up to version 5.5.3 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially accessing sensitive information. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).

Missing authorization in Contact Form 7 AWeber Extension up to version 0.1.38 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially causing limited availability impact. No public exploit or active exploitation has been identified, and the EPSS score is low (0.08%).

Missing authorization in WPFactory CRM ERP Business Solution for WordPress allows unauthenticated attackers to modify data without authentication. The vulnerability affects versions up to and including 1.13, with a CVSS score of 5.3 and low EPSS probability (0.06%). No public exploit or active exploitation has been identified.

A security vulnerability in Missing Authorization vulnerability in thanhtungtnt Video List Manager (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.

A security vulnerability in Missing Authorization vulnerability in aguilatechnologies WP Customer Area (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

A security vulnerability in Missing Authorization vulnerability in mahabub81 User Roles and Capabilities (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

Missing authorization in WP User Profile Avatar plugin for WordPress allows authenticated low-privilege users to access or modify profile avatar data without proper permission checks. Affects versions up to 1.0.6. No public exploit or active exploitation identified.

A security vulnerability in Missing Authorization vulnerability in slui Media Hygiene (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

CVE-2025-49978 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

Missing authorization in WANotifier WordPress plugin up to version 2.7.7 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).

A security vulnerability in a Project Management (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

Missing authorization in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes WordPress plugins allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying image size settings. The vulnerability affects all versions up to 1.0.9 and has a low EPSS score (0.05%), with no public exploit or active exploitation confirmed.

CVE-2025-49971 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

A security vulnerability in Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

Missing authorization in Zara 4 Image Compression WordPress plugin up to version 1.2.17.2 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially causing limited denial of service. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).

CVE-2025-3319 is an authentication bypass vulnerability in IBM Spectrum Protect Server versions 8.1 through 8.1.26 caused by improper session authentication mechanisms. This flaw allows unauthenticated network attackers to bypass authentication and gain unauthorized access to protected resources, potentially compromising backup and recovery infrastructure. With a CVSS score of 8.1 (High) and network-based attack vector, this vulnerability poses significant risk to organizations relying on Spectrum Protect for data protection.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.

CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.

An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key (STK) can be easily guessed. This requires knowledge of the Temporary Key (TK), which, in the case of the COROS Pace 3, is set to 0 due to the Just Works pairing method. An attacker within Bluetooth range can therefore perform sniffing attacks, allowing eavesdropping on the communication.

An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing attackers within Bluetooth range to eavesdrop on the communication. Furthermore, even if a user manually initiates pairing and bonding in the Android settings, the application continues to transmit data without requiring the watch to be bonded. This fallback behavior enables attackers to exploit the communication, for example, by conducting an active machine-in-the-middle attack.

CVE-2024-53298 is a critical missing authorization vulnerability in Dell PowerScale OneFS NFS export functionality that allows unauthenticated remote attackers to gain unauthorized filesystem access without authentication. Affected versions range from 9.5.0.0 through 9.10.0.1, and successful exploitation enables arbitrary file read, modification, and deletion, leading to complete system compromise. With a CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses severe risk to unpatched Dell PowerScale deployments; KEV status and active exploitation details require vendor advisory verification.

Authorization bypass in ScriptAndTools Real Estate Management System 1.0 allows remote authenticated attackers to delete arbitrary users by manipulating the ID parameter in userdelete.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.13%), indicating limited exploitation likelihood.

Unauthenticated file upload vulnerability in Teledyne FLIR AX8 thermal cameras up to version 1.46 allows remote attackers to upload arbitrary files via the /upload.php endpoint. Public exploit code is available, and while the CVSS 4.0 score is low (2.1) due to required privileges, the EPSS score of 0.11% suggests low exploitation probability. No active exploitation has been reported in CISA KEV.

# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.

CVE-2025-31698 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends that Director be upgraded to one of the remediated software versions.

Remote code execution vulnerability in Backup Server that allows authenticated domain users to execute arbitrary code with high severity (CVSS 8.8). The vulnerability requires valid domain credentials but no user interaction, making it a significant risk for organizations with Backup Server deployments in Active Directory environments. If actively exploited or with public POC availability, this represents an immediate priority for patching.

CryptPad versions prior to 2025.3.0 contain a critical authentication bypass vulnerability that allows attackers to circumvent Two-Factor Authentication (2FA) enforcement through a trivial path parameter manipulation. An attacker who obtains valid user credentials can bypass 2FA protection by URL-encoding a single character in the access path, gaining full account access without the second authentication factor. The vulnerability has a CVSS score of 9.1 (Critical) and requires no special privileges or user interaction to exploit.

A remote code execution vulnerability in CloudClassroom-PHP-Project v1.0 (CVSS 9.8). Risk factors: public PoC available.

CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability in the loginlinkadmin.php component that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access by injecting malicious SQL payloads into the username field. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses immediate and severe risk to all deployments. While specific KEV status and EPSS data were not provided in the intelligence sources, the combination of complete authentication bypass capability, high CVSS score, and trivial exploitation complexity suggests this is actively exploitable and likely to be targeted by opportunistic attackers.

In the Linux kernel, the following vulnerability has been resolved: ice: Fix call trace with null VSI during VF reset During stress test with attaching and detaching VF from KVM and simultaneously changing VFs spoofcheck and trust there was a call trace in ice_reset_vf that VF's VSI is null. [145237.352797] WARNING: CPU: 46 PID: 840629 at drivers/net/ethernet/intel/ice/ice_vf_lib.c:508 ice_reset_vf+0x3d6/0x410 [ice] [145237.352851] Modules linked in: ice(E) vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio iavf dm_mod xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun bridge stp llc sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTC O_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl ipmi_si intel_cstate ipmi_devintf joydev intel_uncore m ei_me ipmi_msghandler i2c_i801 pcspkr mei lpc_ich ioatdma i2c_smbus acpi_pad acpi_power_meter ip_tables xfs libcrc32c i2c_algo_bit drm_sh mem_helper drm_kms_helper sd_mod t10_pi crc64_rocksoft syscopyarea crc64 sysfillrect sg sysimgblt fb_sys_fops drm i40e ixgbe ahci libahci libata crc32c_intel mdio dca wmi fuse [last unloaded: ice] [145237.352917] CPU: 46 PID: 840629 Comm: kworker/46:2 Tainted: G S W I E 5.19.0-rc6+ #24 [145237.352921] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015 [145237.352923] Workqueue: ice ice_service_task [ice] [145237.352948] RIP: 0010:ice_reset_vf+0x3d6/0x410 [ice] [145237.352984] Code: 30 ec f3 cc e9 28 fd ff ff 0f b7 4b 50 48 c7 c2 48 19 9c c0 4c 89 ee 48 c7 c7 30 fe 9e c0 e8 d1 21 9d cc 31 c0 e9 a 9 fe ff ff <0f> 0b b8 ea ff ff ff e9 c1 fc ff ff 0f 0b b8 fb ff ff ff e9 91 fe [145237.352987] RSP: 0018:ffffb453e257fdb8 EFLAGS: 00010246 [145237.352990] RAX: ffff8bd0040181c0 RBX: ffff8be68db8f800 RCX: 0000000000000000 [145237.352991] RDX: 000000000000ffff RSI: 0000000000000000 RDI: ffff8be68db8f800 [145237.352993] RBP: ffff8bd0040181c0 R08: 0000000000001000 R09: ffff8bcfd520e000 [145237.352995] R10: 0000000000000000 R11: 00008417b5ab0bc0 R12: 0000000000000005 [145237.352996] R13: ffff8bcee061c0d0 R14: ffff8bd004019640 R15: 0000000000000000 [145237.352998] FS: 0000000000000000(0000) GS:ffff8be5dfb00000(0000) knlGS:0000000000000000 [145237.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [145237.353002] CR2: 00007fd81f651d68 CR3: 0000001a0fe10001 CR4: 00000000001726e0 [145237.353003] Call Trace: [145237.353008] <TASK> [145237.353011] ice_process_vflr_event+0x8d/0xb0 [ice] [145237.353049] ice_service_task+0x79f/0xef0 [ice] [145237.353074] process_one_work+0x1c8/0x390 [145237.353081] ? process_one_work+0x390/0x390 [145237.353084] worker_thread+0x30/0x360 [145237.353087] ? process_one_work+0x390/0x390 [145237.353090] kthread+0xe8/0x110 [145237.353094] ? kthread_complete_and_exit+0x20/0x20 [145237.353097] ret_from_fork+0x22/0x30 [145237.353103] </TASK> Remove WARN_ON() from check if VSI is null in ice_reset_vf. Add "VF is already removed\n" in dev_dbg(). This WARN_ON() is unnecessary and causes call trace, despite that call trace, driver still works. There is no need for this warn because this piece of code is responsible for disabling VF's Tx/Rx queues when VF is disabled, but when VF is already removed there is no need to do reset or disable queues.

A remote code execution vulnerability (CVSS 7.0). High severity vulnerability requiring prompt remediation. Vendor patch is available.

Missing authorization in the Breeze WordPress plugin up to version 2.2.13 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).

The FunnelKit plugin for WordPress (versions ≤3.5.3) contains a critical vulnerability allowing unauthenticated attackers to install arbitrary plugins due to missing capability checks and weak nonce validation in the install_or_activate_addon_plugins() function. This is a pre-authentication remote code execution vector with a CVSS 9.8 severity rating that enables complete site compromise through malicious plugin installation.

CVE-2025-51381 is an authentication bypass vulnerability in KCM3100 version 1.4.2 and earlier that allows unauthenticated attackers on the local network (LAN) to completely bypass product authentication and gain full system access. The vulnerability has a critical CVSS score of 9.8 with no authentication or user interaction required, enabling attackers to achieve complete confidentiality, integrity, and availability compromise of affected devices.

Critical remote authentication bypass vulnerability affecting Teleport Community Edition versions 17.5.1 and earlier, allowing unauthenticated attackers to completely compromise authentication mechanisms over the network without any user interaction. With a CVSS score of 9.8 and no available open-source patch at disclosure, this vulnerability represents an immediate threat to all affected Teleport deployments, enabling full system compromise including confidentiality, integrity, and availability violations.

Pre-authentication remote code execution vulnerability in Trend Micro Endpoint Encryption PolicyServer caused by insecure deserialization. Attackers can exploit this vulnerability over the network without authentication to achieve arbitrary code execution with complete system compromise (confidentiality, integrity, and availability impact). This is a critical, actively exploitable vulnerability affecting Trend Micro Endpoint Encryption deployments; similar to CVE-2025-49213 but in a different vulnerable method, indicating a pattern of insecure deserialization issues in the same product.

Critical authentication bypass vulnerability in Trend Micro Endpoint Encryption PolicyServer that allows unauthenticated remote attackers to gain administrative access and modify product configurations without valid credentials. The vulnerability has a CVSS 9.8 score indicating severe impact (confidentiality, integrity, and availability compromised), and represents a complete authentication control failure requiring immediate patching.

Critical pre-authentication remote code execution vulnerability in Trend Micro Endpoint Encryption PolicyServer caused by insecure deserialization. An unauthenticated attacker can exploit this vulnerability over the network with no user interaction required to achieve complete system compromise (confidentiality, integrity, and availability impact). This vulnerability is actively being tracked and should be prioritized for immediate patching as it requires no privileges or complex attack conditions.