Authentication Bypass

Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.

Authorization bypass in the MediaWiki WikiLambda (Wikifunctions) extension version 1.46 lets an authenticated wiki user reference and operate on objects belonging to another user or scope, because the extension resolves a client-supplied object key without re-authorizing it against the requesting account. Exploitation is gated: the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a valid account, high attack complexity, an attack precondition that must be present, and some victim-side interaction, and only wikis that explicitly install WikiLambda rather than plain MediaWiki are exposed. No confirmed active exploitation is reported (not listed in CISA KEV); the advisory's CVSS 4.0 vector carries an E:P exploit-maturity metric and a Gerrit change is linked, indicating an upstream fix and proof-of-concept-level maturity rather than confirmed in-the-wild attacks, with no EPSS data supplied.

Unauthenticated attackers can reach the Tugtainer Agent's Docker management API and gain effectively full control over containers and the underlying Docker host, because the agent's request-signature check in agent/auth.py returns success whenever Config.AGENT_SECRET is left empty - which is the shipped default. All Tugtainer versions prior to 1.30.4 are affected (CPE cpe:2.3:a:quenary:tugtainer with a wildcard version), though exploitation requires the agent's port (default 127.0.0.1:8001) to be network-reachable, meaning deployments that place the agent on a separate host or otherwise expose it without setting a secret are the realistic victims; deployments that keep the agent internal or set AGENT_SECRET are not reachable. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the issue is fixed in vendor release 1.30.4, which rejects such requests with HTTP 401.

Improper access control in Tugtainer before version 1.30.3 causes the OIDC login flow to start even when OIDC_ENABLED=false, so a direct request to /auth/oidc/login still returns HTTP 302, sets an oidc_state cookie, and redirects the browser to the configured OIDC authorization endpoint despite the disable switch. The vendor scores this 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), but real-world impact is narrower than that score implies: exploitation requires a deployment where OIDC was fully configured (well_known_url, client ID/secret, authorization endpoint) and then toggled off, and the attacker must still complete authentication against that external identity provider to turn the initiated flow into a session. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Tugtainer 1.30.3.

Cross-workspace authentication bypass in Soft Machine 0.2.247 and earlier lets an authenticated paying tenant read, modify, and destructively restore another tenant's workspace through its HTTP API. Two helper functions in /app/server.js, verifyContainerAuth() and authenticateWorkspaceHttp(), accept the app-wide CONTAINER_SHARED_SECRET as a bearer token without validating which workspace the caller owns, bypassing the per-workspace workspaceTokenMatches check; because that secret is identical on every container and readable from the tenant's own process environment, the multi-tenancy isolation boundary collapses. Exploitation requires a valid paid account, adjacency to the target workspace API (AV:A), and no user interaction; no public exploit has been identified at time of analysis and no vendor-released patch is available, so this is assessed at CVSS 9.0 as a genuine high-priority multi-tenancy isolation failure.

Cross-tenant data disclosure in Soft Machine workspaces running version 0.2.247 and prior lets any peer Fly Machine on the same private 6PN mesh read arbitrary files under a workspace's /workspace root and pull entire project trees as tar archives through the unauthenticated /file/<path> and /archive/<dir> endpoints exposed on 0.0.0.0:8080. Exploitation is bounded by network topology rather than open to the internet: an authenticated tenant that controls another sm-ws-* machine in the same Fly app/org can reach peer workspaces (discoverable via the unauthenticated _instances.internal TXT record) with no further authentication, credentials, origin check, or user interaction, while single-tenant or network-isolated deployments are unreachable by outside parties. At time of analysis no public exploit code has been identified and no vendor patch is available, but the missing trust boundary between workspace owner and co-tenants makes this a genuine confidentiality risk anywhere multiple tenants share a Fly org.

Unauthenticated firmware replacement on PTZOptics PTZ cameras and the vendor's Firmware Upgrade Tool lets anyone who can reach the device's update endpoint flash a modified firmware image onto the hardware, handing the attacker persistent control of the camera without ever supplying administrator credentials. Rated CVSS 9.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N with full confidentiality, integrity and availability impact), the missing-authentication flaw (CWE-306) covers the Move/Link/Studio 4K and SE families below their respective fix builds, every Generation-2 camera (PT12X/PT20X/PT30X SDI/NDI/USB, ZCAM variants, Studio Pro) at all versions, and all versions of the Upgrade Tool. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing) at time of analysis, but because exploitation is unauthenticated and needs no user interaction the only real gating factor is network reachability - these cameras normally sit on AV/production VLANs rather than the public internet, so an attacker must first gain a foothold on the same segment and then craft a firmware image the device accepts.

Missing authorization in the NVIDIA vGPU GPU kernel driver lets a low-privileged user inside a guest VM reach privileged host GPU resources on Windows and Linux hosts, giving up to code execution, privilege escalation, data tampering, denial of service, and information disclosure on the hypervisor-side GPU stack. Exploitation requires local code execution within a guest (CVSS AV:L, PR:L, UI:N) in a vGPU deployment, so it is a realistic escalation primitive for tenants of shared-GPU, VDI, and cloud desktops rather than an internet-facing issue. No public exploit identified at time of analysis; risk is operator-context-dependent, but the high CIA impact and easy automation make prioritization relevant wherever untrusted tenants share vGPU capacity. Authentication requirements are confirmed as low-privileged/authenticated (CVSS vector PR:L).

Information disclosure and data tampering can be achieved by a local low-privileged attacker exploiting a missing authorization check in the NVIDIA GPU Display Driver for Windows kernel module. Affected products include the GeForce, RTX/Quadro/NVS, and Tesla driver branches on Windows; exploitation requires local authenticated access (PR:L) and no user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis; the CVSS score is 7.3 with scope change (S:C) that amplifies risk in multi-user or cloud-GPU environments.

Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged local user to bypass read-only memory protection and gain write access to memory the driver marked read-only, which can result in kernel code execution, denial of service, privilege escalation, information disclosure, and data tampering. Exploitation requires the attacker to already hold low-privileged local access on an affected Linux host (CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N, score 7.8) with no user interaction and no network vector; the risk is greatest on shared, multi-tenant vGPU, VDI, and cloud-GPU hosts where crossing the user-to-kernel boundary breaks tenant isolation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but NVIDIA has published a fix through security bulletin 5861. This is a genuine local privilege-escalation risk rather than an emergency, and it should be prioritized on multi-tenant GPU infrastructure.

Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass an authorization check in the driver's kernel-mode escape handling, gaining kernel-level capabilities that can lead to code execution, data tampering, information disclosure, or denial of service on the affected host. The issue is classified as CWE-863 (incorrect authorization) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is strictly local with no remote or network attack surface. No public exploit code has been identified and the vulnerability is not listed on CISA KEV, so it should be treated as a genuine but access-gated privilege-escalation risk concentrated in multi-user, VDI, and cloud-GPU hosts where an untrusted tenant or guest driver instance can reach the driver's escape interface.

Local privilege escalation in NVIDIA's GPU Display Driver (GeForce, RTX/Quadro/NVS, and Tesla, on both Windows and Linux) allows an authenticated low-privileged local user to reach GPU memory belonging to another process, enabling code execution, escalation of privileges, data tampering, denial of service, and information disclosure. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) there is no remote or network path; the flaw is most consequential on shared, multi-user, VDI, or multi-tenant GPU hosts where cross-process GPU memory isolation is the boundary between users and tenants. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the provided vendor reference points to NVIDIA's product security advisory (2026/5861) rather than a fixed driver version named in this data set.

Local privilege escalation in NVIDIA GPU Display Driver for Linux stems from a missing authorization check in the kernel mode layer, allowing an unprivileged local user to modify privileged configuration and potentially achieve code execution, escalation of privileges, denial of service, information disclosure, and data tampering. Exploitation requires a pre-existing local low-privileged foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), such as an unprivileged account on a host or inside a guest VM using the NVIDIA guest driver or Virtual GPU Manager, so this is an escalation primitive rather than a remote initial-access vector. No public exploit code is identified and no CISA KEV active exploitation is confirmed at time of analysis, but the high confidentiality, integrity, and availability impacts and broad affected driver families make patching a priority.

Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197.

Incorrect authorization in JetBrains YouTrack before version 2026.2.19197 allows guest users to strip a workflow action's visibility restriction and then execute that action, altering workflow behavior on the instance. The flaw is network-reachable and rated CVSS 7.5 with a PR:N vector, though practical exposure depends on guest access being enabled on the target instance - a configuration in which the guest context supplies the effective precondition; disabling guest access removes the attack surface entirely. Impact is limited to integrity of workflow actions (no confidentiality or availability effect), there is no public exploit identified at time of analysis, EPSS is low (0.29%, roughly 19th percentile), CISA SSVC records exploitation status as none, and the vendor has released a patch in 2026.2.19197.

Incorrect authorization in JetBrains YouTrack before 2026.2.18991 lets a user who holds only read-only access to a project overwrite that project's notification templates, an action that should require higher project privileges. The attack is network-reachable and needs no user interaction, but it does require an authenticated account (CVSS PR:L) that already has visibility into the target project, and the effect is scoped to a single project's notification configuration. Severity is moderate (vendor score 7.1; independently assessed impact limited to integrity, with no confidentiality or availability effect), EPSS is low at 0.31% (22nd percentile), CISA SSVC rates exploitation as none and non-automatable, and no public exploit code has been identified at time of analysis. JetBrains has released a fix.

Unauthenticated HTTP requests to LightLLM through 1.2.0 can halt and wedge inference workers on any deployment started with the --enable_rl flag, because the reinforcement-learning control routes (/pause_generation, /abort_request, /flush_cache, /init_weights_update_group) are mounted on the public API with no authentication check (CWE-306). An attacker who can merely reach the API over the network can pause generation, abort in-flight requests, repeatedly flush the cache, or disturb weight-update groups, degrading or fully interrupting service availability, with no data disclosure or modification possible through these routes. Risk is bounded by the non-default RL configuration and by network exposure of the API; no public exploit identified at time of analysis.

Authentication bypass in Trex MES allows unauthenticated attackers positioned on the same adjacent network segment to invoke a critical function without supplying credentials, delivering full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is limited to attackers who can reach the MES host over the local or OT network - the flaw is not reachable from the public internet - but no privileges or user interaction are required and attack complexity is low, so any host on that segment can trigger it against affected builds through 2026-09-29. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure depends almost entirely on how tightly the MES network is segmented.

Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.

The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.

Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce sites that have the Customer Reviews for WooCommerce plugin installed and active at version 5.120.0 or earlier. The flaw is a missing authorization check (CWE-862) on a network-accessible endpoint, requiring no authentication or user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is a genuine but bounded priority because impact is confined to availability/data loss rather than site compromise.

Unauthenticated attackers can modify arbitrary data or trigger protected operations in WordPress sites using the WP Express Checkout (Accept PayPal Payments) plugin versions up to and including 2.4.9, because the plugin fails to enforce authorization controls (CWE-862). The flaw is remotely exploitable without user interaction or credentials, with a CVSS 3.1 base score of 7.5 reflecting high integrity impact but no confidentiality or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a Patchstack advisory exists and administrators should treat the issue as high priority given the unauthenticated attack vector.

Broken access control in the MakeCommerce for WooCommerce WordPress plugin (versions up to and including 4.1.0) lets a low-privilege authenticated Subscriber reach a plugin action that is missing its capability check, allowing unauthorized modification of store data. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2, but our independent assessment adjusts the privilege requirement to PR:L, since the 'Subscriber Broken Access Control' classification implies an authenticated Subscriber session is needed; open registration on many WooCommerce stores makes obtaining such an account trivial. The result is high integrity impact and limited availability impact with no confidentiality exposure, no user interaction required, and no public exploit identified at time of analysis.

Unauthenticated remote attackers can modify or create data in WordPress sites running the Bookly appointment booking plugin versions up to and including 28.2 due to missing authorization checks (CWE-862). The vulnerability has a CVSS score of 7.5 with a vector indicating network exploitable, low complexity, no privileges required, and no user interaction, resulting in high integrity impact but no confidentiality or availability impact. No public exploit code has been identified at the time of analysis, and the issue is assessed as priority-worthy on exploitability but with a bounded impact profile.

Unauthenticated Broken Access Control in the Hostinger Migrator WordPress plugin (version 1.0 and earlier) lets any remote attacker reach a plugin endpoint that performs no authorization check, exposing migration and backup artifacts such as database dumps, file archives and site configuration data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) the impact is a high-confidentiality breach with no integrity or availability effect, exploitable against default installations with no credentials, user interaction or special configuration. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the practical risk is bounded by the plugin's niche adoption and the fact that migration plugins are often left active only briefly during a site move, so sites that have deactivated or removed the plugin since migrating are not exposed.

Missing authorization checks in the FormGent WordPress plugin (versions through 1.12.2) allow an authenticated user holding only a subscriber-level account to reach form-management functionality and data normally reserved for higher-privileged roles, yielding high confidentiality impact and limited integrity impact. The flaw is network-reachable and needs no user interaction, but it does require a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), so sites that permit open user self-registration are the most exposed while registration-restricted sites are considerably less at risk. No public exploit identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).

GravityExport Lite for Gravity Forms versions up to and including 2.7.2 contains a broken access control vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass authorization and access sensitive export data, resulting in high confidentiality impact. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a low-complexity, network-exploitable flaw with no integrity or availability impact. Exploitation requires the plugin to be installed on a site with Gravity Forms, but no authentication or user interaction is needed; no public exploit code is currently identified.

Authentication bypass in the YunoHost-packaged SOGo application (sogo_yhn) allows unauthenticated remote attackers to log in to any existing user account by supplying only that user's username together with an arbitrary password, rated CVSS 9.2. The root cause is the package's default configuration of SOGoTrustProxyAuthentication=YES, which causes SOGo to skip password verification during HTTP Basic authentication; every package version prior to 5.8.0~ynh9 is vulnerable by default, so exposed instances are broadly at risk. No public exploit code or exploitation telemetry has been identified at time of analysis, but the bypass requires no specialized tooling beyond knowing a valid username (typically derivable from email addresses), and the vendor has released a fixed version.

Authentication bypass in the YunoHost sogo_yhn package lets any remote client impersonate an arbitrary SOGo user - including a privileged administrator - by simply sending an HTTP header, with no password required. The package configures SOGo to treat the 'x-webobjects-remote-user' header as a verified identity, and the bundled Nginx reverse proxy does not strip that inbound header, so it reaches the backend untouched; both the vendor CVSS 4.0 score (9.3) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirm unauthenticated, network-reachable, high-impact compromise without user interaction. The flaw is fixed in version 5.8.0~ynh9; no CISA KEV listing is associated with this CVE and no public exploit code was identified at time of analysis, but the trivial attack primitive (single header) and the exposed default configuration make prompt patching or proxy-level header stripping essential.

WS-Security policy bypass in Apache WSS4J (4.0.0 <4.0.2, 3.0.0 <3.0.6, and 0 <2.4.4) allows an unauthenticated remote attacker to exploit EncryptedHeader child confusion so that an attacker-controlled plaintext element is promoted as the decrypted header, undermining confidentiality coverage and enabling WS-SecurityPolicy bypass. Per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1), the flaw is network-reachable with low complexity, requires no authentication and no user interaction, and can affect both confidentiality and integrity - typically through Apache CXF-based SOAP services that decrypt EncryptedHeader elements and enforce WS-SecurityPolicy. Exposure is limited to deployments that actually rely on encrypted SOAP headers and policy enforcement; services not using WS-Security header confidentiality are not meaningfully exposed, and no public exploit code was identified at time of analysis.

Unauthenticated remote attackers can bypass authentication in Apache WSS4J (4.0.0 before 4.0.2, 3.0.0 before 3.0.6, and 2.x before 2.4.4) and forge authenticated SOAP messages by submitting a crafted unsigned SAML sender-vouches assertion that carries an attacker-controlled key, which the DOM security processor accepts as proof of identity. Any SOAP service configured to accept and validate SAML sender-vouches assertions through that processor is exposed at the network layer alone, with no credentials and no user interaction required, yielding critical confidentiality and integrity impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). At time of analysis no public exploit code and no confirmed active exploitation were identified, but the low attack complexity and the fact that the vulnerable code path is a security trust boundary make this a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk case; remediation is straightforward because vendor patches exist.

Privilege escalation in MISP before 2.5.48 allows an authenticated user who holds the tag editor permission (perm_tag_editor) to smuggle sibling User and Organisation records into tag collection create or edit requests, which the affected controller then persists alongside the intended tag collection - letting the attacker create or modify accounts and escalate to site administrator. Exploitation requires network access to the instance and a delegated tag-editor role; no user interaction or administrative rights are needed, and the accompanying source fix (commit 96f735e7b) shipped in MISP 2.5.48. No public exploit code was identified at time of analysis, and instances that never delegate perm_tag_editor to non-administrative accounts are not exposed to an unprivileged external actor.

Cross-tenant record tampering in MISP (Malware Information Sharing Platform) versions before 2.5.48 lets any authenticated user holding the basic write role (perm_add) overwrite attribute values, re-parent objects into their own events, or soft-delete rows owned by other organizations and events they have no read access to. The root cause is that the CakePHP ORM's set() gives precedence to an attacker-supplied nested key matching the model alias, so MISP's sanitization (primary-key stripping, event_id/object_id pinning) is applied to the outer flat record while the ORM actually persists the inner attacker-controlled one; the independent assessment confirms this is a fully remote, low-complexity exploit (PR:L, no UI) with integrity-only impact that extends across tenants (SI:H), and no public exploit code or in-the-wild activity has been identified at time of analysis. A vendor fix is available via upstream commit 9485ae40d, with the affected range ending at MISP 2.5.48.

Man-in-the-middle attackers can intercept and decrypt sensitive BVMS traffic across versions 4.5 through 12.3 because the product relies on a hard-coded cryptographic key (CWE-321), allowing unauthorized access to confidential data and, per the assessed impact, tampering with protected communications. The flaw is remotely reachable and requires no credentials (PR:N) or user interaction (UI:N), and it carries a high severity rating of 8.7 with a scope change reflecting impact beyond the vulnerable component. Risk is materially gated by the high attack complexity (AC:H): the attacker must first obtain a man-in-the-middle position on the network path between BVMS components, so it is not exploitable purely remotely against an isolated, well-segmented deployment. No confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis.

Unauthenticated remote attackers can retrieve other users' plaintext passwords from Digiwin EasyFlow .NET via a specific API endpoint. This missing authentication vulnerability (CWE-306) affects all versions per the CPE and requires only network reachability to the vulnerable API, as confirmed by the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation in the wild has been identified at the time of analysis.

Authentication bypass in the GiveWP WordPress donation plugin (all versions through 4.16.9) allows remote, unauthenticated attackers to satisfy the plugin's credential/equivalence check with crafted input and reach privileged plugin functionality on any affected site. Scoring CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires only that the plugin be installed and reachable - no account, no privileges, and no victim interaction - with high confidentiality and integrity impact, which makes automated scanning of WordPress installs a realistic attack model. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the severity and trivial preconditions rather than observed exploitation.

Authenticated plugin installation in the Vayu X WordPress theme before 1.0.6 allows any logged-in user - even a Subscriber - to install and activate arbitrary plugins hosted on the WordPress.org repository. The theme's AJAX action omits a capability check (CWE-284) and leaks its guarding nonce to every authenticated user, so the nonce provides no protection whatsoever; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) reflects high integrity impact with no user interaction required. Exploitation is limited to WordPress.org-hosted plugins rather than arbitrary code upload, so maximum impact depends on chaining to a vulnerable installable plugin; no public exploit code has been identified at time of analysis, there is no confirmed active exploitation (CISA KEV), and CISA SSVC rates exploitation as none and automatable as no.

Improper access control in Pexip Infinity's product-internal, inter-node API lets an attacker who already holds a foothold on one node of a multi-node deployment execute arbitrary code as an unprivileged user on another node. The affected builds are Infinity before 38.2 as well as 39.0, 39.1 and 40.0, tracked as CPE cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* and rooted in CWE-863 (incorrect authorization). The internal API requires no authentication (PR:N) and no user interaction (UI:N), but the attack path is adjacent-network only (AV:A) and code runs unprivileged on the target rather than as root; there is no public exploit identified at time of analysis and no CISA KEV listing, though the 8.8 CVSS and lateral-movement potential make this a high-priority fix for any clustered installation.

Authentication bypass in AiSOC 7.5.0 through 11.x lets unauthenticated remote attackers subscribe to realtime WebSocket/SSE channels belonging to any tenant, exposing live alerts, cases, agent events, and graph updates. The realtime edge verifies subscription tickets with a hard-coded HS256 key committed to the repository, and per the patch commit that constant was the effective key in every shipped deployment because no docker-compose or make manifest ever passed AISOC_REALTIME_JWT_SECRET to either the API or the realtime service. Version 12.0.0 removes the fallback entirely and generates a real secret, so only deployments that explicitly set the variable are unaffected; no public exploit code identified at time of analysis, and the assessed impact is confidentiality-only against a very small deployment footprint.

Improper access control in DB-GPT v0.8.0 allows attacker-supplied code to run directly on the host: when the sandbox API cannot resolve its intended isolated runtime, it silently degrades to LocalRuntime instead of failing closed, so submitted code is executed outside the isolation boundary the deployment expected. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-284) and affects any instance that exposes the sandbox/code-execution API and relies on it to contain untrusted code; exploitation conditions require that the API be reachable and the intended runtime be unavailable or misconfigured. There is no confirmed actively exploited (CISA KEV) status and no public exploit identified at time of analysis, and EPSS is low at 0.20% (9th percentile), so the practical risk signals conflict sharply: a critical-severity, unauthenticated-per-vector code-execution path paired with minimal observed exploitation activity and a narrow, version-specific exposure window.

Broken access control in AgentGPT 1.0.0 allows authenticated remote callers to read or modify resources belonging to other tenants by supplying an arbitrary object or tenant identifier to the externally reachable agentRouter tRPC endpoint, which performs data access without owner, tenant, workspace, or membership checks. The independent assessment scores this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting high confidentiality and integrity impact but no availability impact and a required authenticated session, contradicting the original PR:N/A:H vector. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low (0.19%), so exploitation is most plausible in multi-tenant or multi-user deployments where identifiers can be guessed or enumerated.

Improper authorization in WatchGuard Fireware OS's SAML login flow lets an authenticated SAML user who is scoped only to the Access Portal obtain unauthorized Mobile VPN with SSL access by submitting a specially crafted login request. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) confirms this is a bounded privilege-escalation issue: the attacker must already hold a valid low-privilege SAML account, SAML authentication must be configured, the Access Portal must be exposed, and Mobile VPN with SSL must be provisioned (PR:L, AT:P), with no user interaction required. No public exploit code and no CISA KEV entry were identified at time of analysis.

Unauthenticated extraction of permanent, plaintext cloud storage credentials from the Viidure Android dashcam companion application (CVE-2026-96587) gives any party who obtains the publicly distributed APK full read, write, and delete access to backend object storage holding operational files such as firmware and application binaries. Because the credentials are hardcoded in the shipped artifact and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation requires only network reachability to the storage endpoint plus routine decompilation of the app package - no victim interaction, authentication, or non-default configuration is needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is the niche install base of this consumer dashcam app rather than any technical barrier; the independent assessment nevertheless flags this as a genuine high-priority finding because the exposure is architectural (server-side credential revocation is the only real containment) and write/delete scope against firmware could enable tampering with the update channel if the recovered keys retain that privilege.

Authentication bypass in Dockhand before 1.0.40 allows unauthenticated remote attackers to force redeployments of git-backed stacks by sending unsigned webhook requests when a stack's webhook secret is null or unset; the guard fails open and accepts the request. The immediate impact is denial of service through repeated git clone and docker compose operations, while full host compromise is possible only if the attacker also has write access to the tracked git branch to inject a malicious docker-compose.yml with privileged bind mounts. No public exploit identified at time of analysis, and the independent assessment rates exploitation complexity as high for the RCE chain, with the DoS path requiring only network reachability and stack ID enumeration.

Cross-origin requests from attacker-controlled web pages can invoke the mcp-chrome-bridge native-server HTTP API (all versions through 1.0.31) running on the victim's host, allowing script execution, page-content reading, and screenshot capture through the browser automation tools the bridge exposes. The root cause is an origin validation error (CWE-346) that lets cross-origin browser traffic reach endpoints that should be restricted, yielding a CVSS 4.0 score of 8.6 and an independent 3.1 assessment of AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:N. Exploitation requires no authentication but is interaction-gated: the bridge must be installed and running on the victim's machine and the victim must visit or be redirected to a malicious page in a local browser. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.

Cross-tenant data access in SurrealDB before 3.3.0 allows a user holding a valid Database- or Namespace-level account to read, create, and modify records in a different tenant's namespace or database on the same instance. The flaw lies in HTTP session construction: check_auth() validates Basic credentials against the Surreal-Auth-NS/Surreal-Auth-DB headers but then builds the session from the separately supplied Surreal-NS/Surreal-DB headers without verifying that the authenticated principal may access that context, so an attacker simply points the context headers at a foreign tenant. Exploitation requires remote access to the SurrealDB HTTP interface plus an already-valid low-privilege tenant login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.6 on CVSS 4.0); no public exploit code has been identified at time of analysis, but the impact is high in any shared multi-tenant deployment and is fully resolved by upgrading to 3.3.0.

Sandbox escape in Google Chrome's WebView component on Android (versions prior to 154.0.8037.92) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by serving a crafted HTML page to the victim. The flaw is a second-stage, chain-completing bug rather than a standalone remote-compromise vector: it requires an existing renderer-level foothold, high attack complexity, and victim user interaction, which is why CISA's SSVC assessment marks exploitation as 'none', automatability as 'no', and Chromium rates its own security severity as Low despite a 7.5 CVSS base score. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; a vendor patch is available in Chrome 154.0.8037.92.

Hardcoded, shared cloud-API credentials baked into Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 can be extracted by anyone who obtains the publicly distributed firmware package and then reused against the vendor's cloud service in ways outside normal device operation, exposing data the cloud API is meant to protect. The issue is exploitable remotely with no authentication or user interaction (CVSS 4.0 8.7: AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), limited primarily by the attacker's ability to reach the cloud endpoint and by the credentials remaining valid and unrotated. No public exploit identified at time of analysis, and practical exposure is reduced by the narrow deployment footprint of this specific ICS/IoT streaming device.

An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) allows an unauthenticated, network-positioned attacker to circumvent network access controls and reach restricted networks without credentials or user interaction. The vendor-published CVSS 3.1 base score is 8.1 (High), but our independent assessment retains AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation is gated by preconditions outside the attacker's control - the vulnerable state is transient and cannot be forced, so success depends on catching a device in that window rather than on attacker skill. There is no indication of active exploitation (no CISA KEV listing in the supplied intelligence) and no public exploit identified at time of analysis, so the practical risk is a genuine but conditionally-gated one rather than an immediately weaponizable remote compromise.

Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be circumvented by an unauthenticated attacker who is adjacent to the device, resulting in a complete bypass of security restrictions and potentially remote code execution with elevated privileges. Exploitation requires only network adjacency - an associated Wi-Fi client, guest-network user, or any host on the same Layer 2 segment - with no credentials, no user interaction, and low attack complexity, which is why the CVSS 3.1 score reaches 9.6. No public exploit code and no confirmed active exploitation were identified at time of analysis, and devices already updated beyond firmware 3.4.1.0 are not affected.

Broken access control in Liberu CRM 0.9.1 through releases before 10.0.0 lets an authenticated low-privileged user who already holds a pending team invitation escalate privileges and bind a second, attacker-controlled account to the team with full admin rights, granting create, read, update, and delete access over all team-scoped data. The root cause is a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invite rights based solely on whether the requesting email matches an outstanding invitation, combined with missing privilege-level validation in InviteTeamMember, so a POST to the team-invitations route specifying the 'admin' role is accepted. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 10.0.0, which removes the flaw.

Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD (versions 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets unauthenticated remote attackers complete SSH authentication by submitting the literal username "*" with the password "*", because LDAP filter metacharacters from user-supplied credentials are not escaped before being embedded in the search filter. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw is trivially reachable but only on servers that both embed the MINA SSHD library and have deployed and configured sshd-ldap for password or publickey authentication; stock MINA SSHD deployments without that optional component are entirely unaffected, and no public exploit code was identified at time of analysis. Apache ships fixes in 2.20.0 and 3.0.0-M6, which apply proper RFC 4515 escaping.

Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to pass password authentication checks when an SSH server is configured to use LdapPasswordAuthenticator, yielding high confidentiality and integrity impact (rated 9.1 critical). Affected builds are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5; servers that rely on sshd-core's built-in password mechanisms, or that do not use sshd-ldap at all, are not affected. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing), but real-world exposure is sharply limited by the non-default optional component and the explicit LDAP authenticator configuration required - the raw 9.1 score is driven by impact rather than by a broad exploitable population.

A partial authentication bypass in Apache MINA SSHD lets a remote attacker satisfy a repeated-public-key multi-authentication policy by presenting the same public key twice, so a server configured to demand two distinct keys can be entered with only one of them. Affected are versions before 2.20.0 and 3.0.0-M1 through 3.0.0-M5 of the sshd-core component; the vendor assigns CVSS 3.1 8.1 (High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), where PR:L reflects that the attacker must already legitimately possess at least one accepted key pair. Exploitation is confined to the non-default hardened configuration that requires repeated/multiple public keys (the equivalent of OpenSSH's AuthenticationMethods "publickey,publickey"); single-key or password-based deployments are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.

An authentication bypass in Apache MINA SSHD's sshd-core library (versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) allows remote, unauthenticated attackers to skip signature verification during public-key or hostbased SSH authentication, potentially granting an attacker a valid session. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 critical) reflects high confidentiality and integrity impact, but exploitation is gated by a non-default precondition: the server operator must have written explicit custom code enabling the library's 'asynchronous authentication' mechanism and applied it to public-key or hostbased authentication. Apache rates this implementation choice as presumed rare, and servers that do not opt into asynchronous authentication - or that use it only with password or keyboard-interactive auth - are not exposed. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing).

Unauthenticated content and configuration tampering in Marmite's optional built-in development server (all versions through 0.4.2) lets any network-reachable attacker create, modify, or overwrite site content and configuration by posting to the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints, with no credentials or user interaction required. The same handlers pass unsanitized path parameters from handle_create_content and handle_clone_content into filesystem writes, so an attacker can traverse out of the project directory and drop or clobber files elsewhere on the host. Exploitation requires the target to be running `--serve` and reachable over the network - pre-0.4.3 the server bound to 0.0.0.0:8000 by default, and production static sites served by Nginx or Apache are unaffected; no public exploit code was identified at time of analysis, and the vendor released 0.4.3 to fix the issue (loopback-by-default binding plus a documented development-only posture).

Improper authorization in Ollama's experimental agent-mode Bash tool allows an attacker who can influence model output - for example through prompt injection from untrusted content the agent reads - to smuggle extra shell commands past the user approval prompt. Because the approval logic (x/agent/approval.go in 0.14.0 through 0.31.1) authorizes commands by prefix match without parsing shell syntax, appending a control operator such as ';', '&&', or '||' to an already-approved command causes the trailing command to run with full host privileges, yielding high confidentiality, integrity, and availability impact (CVSS 4.0 base 8.5; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R with C:H/I:H/A:H). This is a genuine but conditionally-gated risk rather than a mass-exploitation threat: the attack vector is local, agent mode is an experimental feature that is not enabled by default, and the victim must approve at least one Bash command within the session; no public exploit identified at time of analysis.

Improper access control in the Joomla CMS Web Services (API) application allows an authenticated user who can reach the affected webservice edit tasks to modify items they are not authorized to edit, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Because the flaw is an authorization bypass in Joomla's edit-task ACL enforcement, the primary impact is to integrity (CVSS VI:H), with only limited confidentiality and availability effects. Exploitation requires a privileged, authenticated account (CVSS PR:H) and the webservices/API application to be enabled and reachable; no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) was reported.

MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to the point a 'rememberme' cookie is issued to present that cookie and skip the second authentication factor entirely, defeating the site's multi-factor policy without possessing valid second-factor credentials. The weakness is only meaningful on installations that both enforce MFA and use persistent-login (remember-me) functionality; sites without MFA enabled are not exposed to this specific bypass, and fully anonymous exploitation is constrained because the attacker must interact with the first-factor login flow or otherwise obtain the issued cookie. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has published advisory 20260914 with fix guidance.

Improper access control in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets an authenticated user with webservice API access perform unauthorized mutation (write/change) operations against access-level endpoints, allowing them to alter how content visibility is governed on the site. Exploitation requires the Joomla Web Services API to be enabled and reachable and a valid account (per the assessed vector PR:H, so anonymous internet users cannot trigger it directly); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Rated medium-to-moderate priority - an authorization flaw rather than a critical emergency - with the practical risk concentrated on multi-user or headless/API-enabled sites that grant API tokens to lower-trust accounts.

Missing authorization checks in the MediaWiki TemplateSandbox extension let unauthenticated remote users reach functionality that should be constrained by access-control lists, yielding a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact. Exposure is limited to wikis that have the optional TemplateSandbox extension installed and enabled; a default MediaWiki core installation is not affected, and the fixed releases are 1.46.1, 1.45.5, and 1.43.10 for their respective branches. No public exploit code has been identified at time of analysis (EPSS 0.15%, 3rd percentile) and CISA SSVC records exploitation as none, although the issue is rated automatable with total technical impact, so the risk is serious but not yet observed as active.

TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.

Apache Polaris releases before 1.8.0 allow an authenticated principal that holds permission to create or update Iceberg table properties to plant FileIO client settings - notably s3.endpoint - in table metadata that Polaris subsequently honors when it constructs its own server-side storage client during commits and purges, redirecting server-side storage traffic and exposing request authentication material to an attacker-chosen host. The flaw is classified as missing authorization (CWE-862) and rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so exploitation requires a valid account with the table-property privilege plus a deployment whose catalog storage configuration does not override the endpoint; environments where all table-property writers are trusted operators, or where the catalog pins or overrides the endpoint, are not meaningfully exposed. There is no public exploit identified at time of analysis, EPSS is 0.19% (8th percentile), and the issue is not in CISA KEV; Apache has fixed it in Polaris 1.8.0.

Same-origin policy bypass in Mozilla Firefox's WebExtensions component lets attacker-controlled web content defeat origin isolation and access cross-origin data, producing high confidentiality and integrity impact without availability loss. Exploitation requires a victim running an affected build (prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42) to visit or interact with attacker-controlled content - the CVSS UI:R prerequisite - while no authentication or prior privileges are needed on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1); default configurations are affected because the flaw sits in a core browser component. No public exploit code has been identified at time of analysis, EPSS is low at 0.17% (5th percentile), and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is currently a patch-now hardening issue rather than an actively exploited one.

Static, predefined Telnet credentials in the Shenzhen Dbit T-CPE301K 4G WiFi mini-router allow any attacker already present on the same local network to log into the device's Telnet service on port 23 and obtain full root access. Because the credentials are fixed in firmware and shared across units, no brute-forcing or account setup is required - mere knowledge of the default password is enough to achieve complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) on the router, which sits at a trust boundary for everything behind it. Exposure is constrained to adjacent-network attackers rather than the open internet, so realistic risk comes from other WiFi clients, guest users, or an attacker who has gained a foothold on the local segment; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. A vendor patch is available per the INCIBE advisory.

Privilege abuse in Interprobe Information Technologies Inc. Qorela DC from 1.6.1-RC29 before v1.6.2 allows an authenticated low-privilege user to perform higher-privileged actions because authorization checks are missing on affected application functions. The flaw is network-reachable, low-complexity, and requires no user interaction, resulting in high confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis, and upgrading to v1.6.2 removes the exposure.

Remote attackers without authentication can access the HTTPPublishAdapterTestServlet on Hitachi Energy Asset Suite deployments where the test servlet is exposed, allowing configuration file uploads that can disclose sensitive information and compromise configuration integrity. The flaw is CWE-306 missing authentication, rated CVSS 4.0 8.5 (High), with high confidentiality and integrity impact but no availability impact, and exploitation requires user interaction per the CVSS vector (UI:A). Hitachi Energy states the servlet is intended only for non-production testing, so risk is concentrated in production instances that inadvertently retain it; no public exploit identified at time of analysis.

Unauthenticated attackers able to reach the firmware-update endpoint of Hitachi Energy RTU500 series CMU devices can upload arbitrary firmware through a crafted POST request, gaining control over device functionality without any credentials or user interaction (CVSS 9.1, CWE-306). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no public exploit identified at time of analysis, but the PR:N/UI:N vector means any reachable instance of the affected interface is directly exploitable. Because the impact is rated integrity-high and availability-high with no confidentiality impact (C:N), the realistic outcome is persistent unauthorized firmware that alters or disrupts the device rather than data theft.

Progress Software Fiddler Everywhere 8.0.2 ships a local .NET backend (Fiddler.WebUi) that exposes an HTTP and SignalR RPC endpoint on the loopback interface without any authentication, allowing any local user or process on the same machine to call privileged methods, mint OAuth tokens, and export the application's machine-in-the-middle root certificate. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7) and only exploitable while Fiddler Everywhere is installed and running, but it requires no credentials or user interaction once those conditions hold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the practical risk is credential and trust-anchor theft on shared workstations or hosts where untrusted local software can execute.

Broken object-level authorization in LimeSurvey Community Edition 7.3.0 lets an authenticated user who holds survey-creation rights tamper with questions, answers, and conditions that belong to other users' surveys. The REST survey-patching endpoint validates the caller's permission against the survey ID in the request URL (the attacker's own survey), but the underlying persistence logic resolves the target question (qid) or answer (aid) globally by ID and never confirms the object actually belongs to that authorized survey. The result is an integrity-only impact (CVSS 4.0 7.1 / assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) requiring a valid account plus survey-creation privileges; no public exploit code has been identified at time of analysis, and the vendor has published an upstream fix.

Unauthenticated password reset in mall4j through 4.0 allows remote attackers to take over any storefront account by supplying a target username to the PUT /user/updatePwd endpoint, which lacks authentication checks (CWE-306). Publicly available exploit code exists, and the issue is rated critical (CVSS 4.0 score 9.3; independent assessment CVSS 3.1 9.1 with PR:N). No confirmed active exploitation (CISA KEV) as of analysis, but the low attack complexity and lack of prerequisites make this a high-priority risk for any deployment where the storefront API is reachable.

MetaMCP through 2.4.22 leaks live MCP session identifiers and namespace UUIDs from its unauthenticated GET /metamcp/health/sessions endpoint, and because the session store is keyed solely on the client-supplied mcp-session-id header, an unauthenticated remote attacker can replay a stolen ID to impersonate another tenant's transport session. The attacker can then enumerate and execute the victim tenant's private MCP tools and exfiltrate data using the credentials the victim has forwarded to those tools, rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-639). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but all exploitability signals - unauthenticated network reach, no user interaction, and a directly replayable session credential - indicate genuine high risk for multi-tenant deployments exposed to untrusted networks.

Signature forgery in PyJWT 2.13.0 lets an attacker forge arbitrary JWT claims when an application verifies tokens using both HMAC and asymmetric algorithms and hands a public JWK container (a JWKS document, a bare array, a nested array, or a BOM-prefixed variant) directly to the library as the raw key. Because the version 2.13.0 HMAC key guard only recognizes top-level public JWK objects and misses these container wrappers, public asymmetric key material - which is not secret - is accepted as the HMAC secret, so anyone who knows the target's public key can sign a token with any claims and have it validate. The flaw is an improper-signature-verification issue (CWE-347) rated CVSS 3.1 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and unauthenticated in the sense that no credentials are needed, but real-world urgency is lower than the headline score: exploitation requires a non-default application design that mixes algorithm families and passes container-form keys, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: PyJWT 2.14.0.

Token forgery in PyJWT 2.13.x lets unauthenticated remote attackers mint tokens that the library will accept as authentic: when a public JWK is prefixed with a UTF-8 byte-order mark and passed directly as the raw HMAC secret inside a mixed-algorithm verification path, HMACAlgorithm.prepare_key fails to recognize the material as an asymmetric key and uses the publicly known JWK bytes as the shared secret, so anyone who knows the public key can sign arbitrary claims that verify successfully. The flaw carries an assessed CVSS of 7.4 (integrity-only impact, AC:H, PR:N) and per our independent assessment is conditionally scoped: it requires PyJWT 2.13.0 through 2.13.x, an application that permits HMAC alongside asymmetric algorithms, code that hands a raw public JWK to prepare_key instead of loading it via PyJWK/HMACAlgorithm.from_jwk, and BOM-prefixed key material. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor-released patch is 2.14.0.

Signature forgery in the PyJWT Python library (versions 2.4.0 through 2.13.x) lets a remote, unauthenticated attacker mint forged HMAC tokens whenever an application is misconfigured to accept both HMAC and asymmetric algorithms and passes a DER-encoded public key as the shared verification secret. PyJWT's HMACAlgorithm.prepare_key only rejected PEM- and SSH-formatted asymmetric keys using textual markers, so a DER public key (SubjectPublicKeyInfo, PKCS1, or a DER x509 certificate) slipped through and its public bytes were used directly as the HMAC secret - meaning anyone who knows the public key can sign valid tokens. The flaw is rated CVSS 7.4 with High attack complexity precisely because it requires that specific non-default application configuration; no public exploit code has been identified at time of analysis, and the vendor-released patch is PyJWT 2.14.0.

Signature forgery in PyJWT before 2.14.0 allows an attacker who knows a target's asymmetric public key to forge HMAC-authenticated JWTs when the application mixes HMAC and asymmetric algorithms and passes asymmetric public-key PEM bytes into HMAC verification. The flaw is in is_pem_format in jwt/utils.py, which fails to recognize all PEM formatting variants accepted by the cryptography loader, causing HMACAlgorithm.prepare_key to treat a mutated public-key PEM as an HMAC secret. Exploitation requires a specific non-default deployment pattern-mixed algorithm verification with raw PEM key bytes-and the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; no public exploit identified at time of analysis, and no CISA KEV status was provided.

Privilege destruction in InvoicePlane 1.7.2 allows an authenticated secondary administrator to demote the primary administrator account (user_id = 1) to a read-only Guest role by exploiting a missing object-level authorization check in the Users::form() endpoint. This locks the legitimate owner out of the instance. The vulnerability requires an attacker who already holds a secondary admin account (user_type = 1) and a deployment with more than one administrator; no public exploit code or active exploitation has been identified at time of analysis, and no vendor patch is currently available.

Account takeover of the InvoicePlane primary administrator (user_id=1) is possible for any authenticated secondary administrator (user_type=1, user_id != 1) on version 1.7.2 prior to commit 8616fa4. The attacker uses Users::form(), which performs no object-level authorization check on the primary admin's record, to overwrite the primary administrator's user_email value (it is not listed in PROTECTED_FIELDS), then drives the instance's public, logged-out password-recovery flow that resolves accounts by user_email to obtain the reset token and seize control of user_id=1. This is an alternate path around the earlier fix in PR #1638, which protected only Users::change_password(); no public exploit code was identified at time of analysis and there is no CISA KEV entry, but the vendor has published a GitHub Security Advisory (GHSA-77hm-22wp-96wp) and a patch commit.

Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.

Signature verification bypass in Authlib 1.7.2 and earlier allows unauthenticated remote attackers to have crafted JWS JSON Serialization payloads accepted as valid, because JsonWebSignature.deserialize_json() returns the payload without checking for a signature or requiring a cryptographic key. The flaw affects applications that use that method to process incoming tokens and then trust the returned payload for authentication, authorization, or integrity decisions; applications using only compact JWS or independently verifying signatures are not exposed. No public exploit code has been identified at time of analysis, and EPSS is low at 0.12% (2nd percentile), but the issue is remotely exploitable with no authentication or user interaction and is assessed as high severity.

Authentication bypass in the LiteLLM proxy lets any party who already holds a valid JWT issued by the configured external identity provider impersonate an existing user - including accounts with proxy_admin privileges - by presenting a token whose unverified email claim matches the victim's address. The JWT authentication flow performs an email-based fallback lookup without validating the email_verified claim, so the attacker inherits the victim's role and can permanently overwrite the victim's stored identity binding, retaining persistent access to administrative endpoints that expose API keys and user management. The attacker must possess a legitimately signed token from the same IdP (CVSS PR:L, AC:H), deployments that do not use JWT/IdP authentication are unaffected, and publicly available exploit code exists; no confirmed in-the-wild exploitation has been reported.

Unauthenticated access to Bluehood's /api/* endpoints in releases before 0.7.1 lets any network attacker who can reach the dashboard HTTP port read Bluetooth tracking data and rewrite application state - the heartbeat URL, prune retention, device groups and per-device notes - whenever the operator has enabled the opt-in auth_enabled setting. The root cause is a missing authorization check: only the HTML page handlers called the session-validation routine, while the settings, devices, groups and /api/device/{mac}/notes handlers performed no check at all, allowing requests carrying no session cookie to succeed (CWE-306, CVSS 3.1 9.1 with PR:N/AC:L). Real-world urgency is tempered by the niche deployment and the fact that the dashboard must be reachable over the network rather than bound to localhost; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

Redirect-policy bypass in Axios 1.17.0 up to (but not including) 1.20.0 causes the fetch adapter to follow HTTP 3xx redirects even when the application explicitly sets maxRedirects: 0, so a redirect-blocking control that developers rely on as a security boundary is silently ignored. The flaw is a confused-deputy issue (CWE-441): an attacker positioned to control a redirect response from a server the application calls can push the request to internal responses or state-changing internal endpoints that should have been unreachable. Exploitation requires three simultaneous conditions - use of the fetch adapter (not the default http/xhr adapters), an explicit maxRedirects: 0 setting used as a security control, and an attacker-influenced redirect target - and per the independent assessment it is unauthenticated (CVSS PR:N) with only a single additional precondition (AT:P), yielding no direct impact on the axios host (VC/VI/VA:N) but high confidentiality and integrity impact on the subsequent internal systems reached (SC:H/SI:H). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).

Authorization bypass in Apache Karaf before 4.4.12 allows an authenticated JMX client holding any role - including the least-privileged 'viewer' - to evade RBAC and achieve remote code execution inside the Karaf JVM. Karaf's MBeanServer guard never checks the lifecycle operations createMBean, registerMBean and unregisterMBean, so a caller can instantiate and register the standard javax.management.loading.MLet class and then invoke its getMBeansFromURL operation, which the shipped default 'get* = viewer' ACL wildcard inadvertently authorizes, causing attacker-hosted classes to be fetched and loaded as new MBeans. Exploitation requires network reachability to the default-enabled remote JMX RMI connector on ports 1099/44444, a valid JMX credential of any role, and outbound network access to the attacker's .mlet host; no public exploit code and no active exploitation were identified at time of analysis, and the issue is rated important by the vendor while the independent assessment places it at high impact across confidentiality, integrity and availability.

Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.

Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.

Missing authorization in WarehousePG (WHPG) 7.x before 7.6.0-WHPG lets any authenticated database role - with no superuser rights, no GRANT, and no special role membership - call the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink and pg_logdir_ls, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived _v1_1 implementations during the merge onto a PostgreSQL 12 base. An attacker holding ordinary database credentials can therefore create, append to, overwrite, rename and delete files under the data and log directories and enumerate log file names, and by appending directives such as shared_preload_libraries or archive_command to postgresql.auto.conf can achieve arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected because its equivalent functions enforce an internal superuser check, and no public exploit code has been identified at time of analysis (no CISA KEV entry).

An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.

Cross-tenant authorization bypass in SUSE Rancher Fleet allows a party who can perform agent-initiated cluster registration into a Fleet workspace namespace shared with other tenants to inject attacker-controlled cluster labels - including reserved management.cattle.io/ labels such as the cluster display name - that are then persisted onto the upstream Cluster object. Because Fleet resolves GitRepo and Bundle targeting from those labels, the attacker's own cluster can be made to satisfy targeting rules administrators intended for a different tenant's cluster, causing content such as Git repos and bundles to be deployed to the wrong cluster. The flaw affects Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older releases; exploitation is conditional on a multi-tenant deployment with a shared workspace namespace and label-based targeting, requires a low-privileged authenticated position (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), and no public exploit code has been identified at time of analysis.