Authentication Bypass

Account takeover in the WooCommerce Telegram Bot plugin through version 1.3.0 allows unauthenticated remote attackers to obtain a persistent WordPress authenticated session for any user whose login name they know, including administrators. The plugin exposes a Telegram webhook REST route without authentication or signature checks and then issues a login cookie through a second unauthenticated endpoint, with the token derived from attacker-influenced values. No public exploit identified at time of analysis, but the priority is act_now because exploitation needs only the target username and the default plugin configuration.

Unauthenticated HTTP requests to the /nodered endpoint of FUXA 1.3.2-2809 can bypass authorization and reach a code-execution path, giving a network attacker high impact to confidentiality, integrity, and availability (CVSS 9.8). The vulnerable component is FUXA's Node-RED integration endpoint; the supplied intelligence does not identify a CISA KEV designation or public exploit code at time of analysis, while the vuln.today priority decision is act_now. Internet-exposed or broadly reachable FUXA deployments that expose /nodered should therefore be treated as urgent exposure, whereas strictly segmented instances are less directly reachable.

Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacker rewrite the plugin's stored settings and turn the site into a delivery point for arbitrary scripts. The configuration-update request is never authenticated; the only gate is a secret that is exposed in public page HTML, so no credentials, user interaction, or non-default configuration is required on any site running an affected version. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the vendor has released a fix in 1.0.25 and the issue was reported by Canva, the plugin's maintainer.

Forkyz versionCode 8500000 mishandles authorization in its URI handler (CWE-863), letting crafted URI strings modify another user's storage settings. Our assessment scores this CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - local attack vector, low integrity impact only - which conflicts sharply with the published 7.5 (AV:N/UI:N/I:H) rating; the exact trigger path and whether the victim must open a link or a co-installed app can deliver the URI are not described in the available sources. No confirmed working exploit code is publicly identified, EPSS is 0.17% (6th percentile), and there is no CISA KEV entry; priority is 'this_week' based on the supplied decision signal.

NoNonsense Notes (versionCode 72600) permits an unauthorized write into another user's notes: the NotificationHelper component is accessible without adequate permission enforcement, so a caller that supplies a note id belonging to someone else can modify that note. Exploitation requires local presence on the device - a malicious or unauthorized app, or a secondary on-device user/profile, must be able to reach the component - and the impact is integrity-only, with no read of note contents and no availability effect; the supplied CVSS 7.5 scoring assumes a network vector (AV:N), whereas the assessed vector is AV:L/AC:L/PR:N/UI:N, which better matches an Android in-app permission flaw. No public exploit code or PoC has been identified at time of analysis, there is no CISA KEV entry, and no EPSS data was provided; the finding is carried as a this-week priority rather than emergency action, and the precise trigger inside NotificationHelper (for example an exported component or a missing permission check) is not described in the available sources.

Shelter, the Android work-profile isolation app, fails to properly authenticate callers into its binder service in versionCode 445, allowing an attacker to register their own auth_key and take over another user's binder service API and preference state. The NVD record scores this 9.8 with an AV:N vector, but the assessed vector is AV:L: the binder interface is on-device IPC, so the realistic attacker is a locally present or co-resident app on a device where the affected Shelter build is installed and used for profile isolation, and no elevated privileges or user interaction beyond that presence are required. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the priority decision on the item is act_now.

Simple Contacts Pro (SimpleMobileTools/Simple-Contacts, distributed via F-Droid) at versionCode 107 ships with insecure permissions on its notes database, letting a second device user profile or a co-resident application read and write notes belonging to another user without any privilege grant or user interaction. The trigger is local rather than network-based: the input CVSS vector claims AV:N and a 9.1 score, but the mechanism described - an Android app's private note store being accessible to another principal on the same device - requires the attacker to already be present on the device, which is why our assessment re-scores it as AV:L with C:H/I:H. Priority is act_now under vuln.today triage, with SSVC recording a proof-of-concept and total technical impact, while CISA KEV contains no entry for this CVE; the SSVC 'poc' status indicates a public proof-of-concept reference exists, but it is not verified as working exploit code, and no fixed version is provided in the available sources.

GPSLogger for Android versionCode 137 (package com.mendhak.gpslogger) assigns insecure permissions to its logging mechanism, allowing an unauthorized local party to manipulate logging behavior and log data. The issue is an integrity-only weakness (CWE-732); confidentiality and availability are unaffected. The headline CVSS is 7.5 High with a network vector, but the assessed vector is local (AV:L), reflecting that exploitation realistically requires local presence, such as another app on the same device. No public exploit code or CISA KEV entry was identified at time of analysis, and the specific exposed component or trigger is not described in the available sources.

wbpxre150 Shopping List v11.0 (versionCode 11) exposes an exported Android component that performs no caller permission or authentication check, so any other app already installed on the same device - or an ADB/shell session - can send it an intent and alter the user's shopping-list data. The published CVSS of 9.1 reflects a network-reachable view of the flaw, but the assessed vector (AV:L/AC:L/PR:N/UI:N/C:L/I:H/A:N) confirms there is no purely remote network path: the attacker must already have code executing on the victim handset, and impact is confined to this app's list data with no confidentiality or availability effect established. A public PoC reference exists (SSVC exploitation: poc) but is not verified as working exploit code; EPSS is low at 0.17% (6th percentile), yet the vuln.today decision label is act_now given total technical impact and full automatability, with exposure further limited by the app's very small user base.

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allow an attacker who can reach the app's MAXS command/transport mechanism to manipulate it, with integrity impact only and no confidentiality or availability effect. The independent assessment scores this as CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N rather than the supplied AV:N vector, and the exact trigger surface is not described in the available sources; practical exposure is likely tied to local device presence or a malicious co-installed app. EPSS is 0.17% (6th percentile), SSVC records exploitation as 'poc' and a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry is provided, so the real-world priority remains low despite the 7.5 base score.

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) let a locally positioned attacker read another user's note data without authentication or user interaction. SSVC records a proof-of-concept (not verified as working exploit code), EPSS is 0.17%, and no CISA KEV entry is present, though vuln.today assigns act_now priority. The supplied CVSS 9.1 vector claims network reachability, but independent assessment finds AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so local access is required and only confidentiality is impacted.

Cross-tenant read of agent execution configuration in TransformerOptimus SuperAGI v0.0.14 allows any authenticated user from one organization to retrieve another organization's agent execution configuration by supplying a victim's agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The get_agent_execution_configuration handler in superagi/controllers/agent_execution_config.py performs no organization ownership check on the selected agent and execution, so confidentiality of stored configuration data - potentially including model API keys or agent instructions - is exposed on multi-tenant deployments. Independent re-scoring places the impact at C:H/I:N/A:N rather than the integrator's 8.8, EPSS is 0.26% at the 17th percentile, KEV does not list it, and no public exploit was identified at time of analysis.

Share to Clipboard 1.14.1 on Android exposes an improperly protected clipboard-write component, letting an unauthenticated local attacker-such as a co-installed app or another Android user/profile on the same device-overwrite another user's clipboard contents. The published CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N), but the assessed vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N: exploitation requires local presence on the device, integrity impact is limited to clipboard overwrite, and there is no confidentiality or availability effect. No public exploit was identified at time of analysis.

The canvoki vokibot Android app at versionCode 14 exposes its ShortcutDispatchActivity without adequate access control, so a caller on the same device can dispatch a shortcut and thereby fire automated actions that another user configured. Our assessment places the realistic threat as a local, on-device attacker (for example a malicious or compromised co-installed app able to send an intent to the activity), with high integrity impact and no confidentiality impact; the originally published CVSS of 9.1 with AV:N should be reconciled against that local component-model precondition. The EPSS score is low at 0.17% (6th percentile) and no confirmed active exploitation or public exploit code was identified at the time of analysis, although the prioritization label is act_now, and the flaw is scoped narrowly to a single F-Droid app build.

Insecure content-URI handling in Ultimate Screenshot Painter versionCode 240213.009 allows a co-resident Android app to move or overwrite files in another app's private storage, an integrity-only impact with no confidentiality or availability loss. The authoritative assessment is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), requiring a malicious app on the same device, even though the supplied feed score is 7.5 with a network vector; SSVC records proof-of-concept availability, and there is no CISA KEV confirmation of active exploitation.

Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.

Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote attackers read content that WordPress would otherwise withhold, including draft and private posts and WooCommerce coupon records, through the plugin's /wp-json/bricks/v1/query_result REST endpoint. An attacker submits crafted post_status and post_type values inside the originalQueryVars parameter; the required nonce is described as publicly obtainable, so it does not act as a real barrier, and no authentication or user interaction is needed. Scored 7.5 with confidentiality-only impact (CWE-862) and flagged as a this-week priority; no public exploit identified at time of analysis.

Unauthenticated remote attackers can pull a ZIP of the Signal K Server log/config directory from the /skServer/ziplogs route in every signalk-server release before 2.33.0, and that archive contains security.json with the server's HS256 JWT signing key. Possession of the secretKey lets an attacker forge administrator tokens or create a persistent admin account and then authenticate through the normal login flow, yielding full control over NMEA routing, plugin configuration and alarms on affected installations, including vessel deployments. The endpoint was confirmed reachable without credentials on a live signalk-server 2.32.0 instance and roughly 66 potentially affected servers were visible to Shodan at disclosure; no public exploit identified at time of analysis, and the vendor addressed the issue in 2.33.0 by placing the route behind admin middleware.

Cross-user Store access in LangGraph API (pip package langgraph-api) versions 0.1.2 through 0.14.x lets an ordinary authenticated user read, overwrite, search or delete Store data belonging to another user. The flaw only manifests in deployments running JavaScript or TypeScript custom authentication whose Store authorization handler restricts users by rewriting the requested namespace: the rewritten namespace is not carried across the runtime boundary and applied before the Store operation, so the original (attacker-supplied) namespace is used instead (CWE-639). Python custom authentication and JS/TS handlers that reject unauthorized namespaces rather than rewriting them are unaffected; vendor CVSS 4.0 scores it 8.6 High and the issue is fixed in 0.15.0, with no public exploit identified at time of analysis.

An authentication bypass in Apache Qpid Proton C through 0.40.0 lets a remote peer step past SASL authentication by sending AMQP performatives that claim to be SASL frames, which the vendor rates as important severity. Impact is conditional rather than automatic: the bypass leaves no user name set, so authentication has not actually completed, and the real outcome depends on whether the hosting application tolerates an identity-less session or falls back to a default identity. No public exploit code or active exploitation was identified at time of analysis, and the vendor has published 0.41.1 as the fixed release tracked under PROTON-2945.

Gearboy's optional `--mcp-http` MCP transport (the affected Gearsystem component) exposes emulator and debugger control tools to any network peer that can route to port 7777, because the socket binds INADDR_ANY while documentation and runtime logging describe a localhost-only service. Unauthenticated POST requests to `/mcp` reach dispatch with no `Authorization`, `Host`, or `Origin` gate, and even a garbage bearer token does not block them, letting a remote caller initialize an MCP session, list tools, and invoke mutating operations such as `write_memory` and `write_z80_register`. Exposure requires the operator to have started the HTTP transport explicitly (stdio is the default MCP mode); impact is bounded to the emulator process, debugging state, and local files the emulator loads as media, with no demonstrated host code execution. Gearboy 3.8.7 contains the patch, and the advisory includes a proof-of-concept reproduction; no confirmed public exploit code or CISA KEV listing is available.

AI Gateway Payload Processing allows an authenticated tenant to submit another tenant's model identifier, causing the service to inject the victim's LLM API keys and consume the victim's model resources and quotas; CVSS 3.1 score is 9.1 with scope change and high confidentiality impact. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key) and requires a valid tenant account plus knowledge or guessing of the target model identifier. No public exploit identified at time of analysis, but the act_now priority label reflects the critical cross-tenant key exposure.

Authorization bypass in the Rucio `/credentials/signurl` REST endpoint lets any holder of a valid auth token obtain presigned read, write or delete URLs for arbitrary objects in cloud-backed storage. The endpoint performs its root-only permission check against the client-supplied `X-Rucio-Account` header rather than the token-authenticated identity, so a low-privilege user can simply send `X-Rucio-Account: root` and have the server sign a URL with the RSE's stored S3/GCS/Swift credentials. Exploitation requires an authenticated account (CVSS PR:L) and a cloud-backed RSE, with no user interaction; the advisory documents a proof-of-concept request, and no active exploitation is confirmed (not in CISA KEV).

Echo's Proxy middleware can forward later HTTP requests straight to the configured upstream without invoking Echo's router or route-specific middleware after a client WebSocket upgrade is rejected by that upstream with an ordinary keep-alive response. This affects Echo v4 releases from 4.0.0 through 4.16.0 and v5 releases from 5.0.0 through 5.4.0, and can let unauthenticated remote attackers reach upstream resources that rely solely on Echo route-level authentication or authorization. Exploitation is conditional-it needs a reachable proxy route, an upstream that keeps the connection alive after rejecting the upgrade, and a target with no independent upstream authorization-so the independent assessment rates it high severity with high attack complexity; fixed releases are 4.16.1 and 5.4.1, and no public exploit or CISA KEV entry was identified at time of analysis.

russh's SSH agent server signs with keys loaded under the confirm constraint without ever invoking the application's approval hook, so any process able to reach the agent socket - another local process running as the same user, or the remote host when the agent is forwarded with ssh -A - can authenticate or sign data as the user while the key stays loaded. The regression spans russh 0.50.0-beta.12 through 0.64.1 and only affects applications that override Agent::confirm with a real approval or policy check; the default always-true confirm and checks implemented in Agent::confirm_request remain effective, and the private key itself is never exposed. The vendor advisory ships a reproducible test PoC demonstrating the bypass (a unit test, not working exploit code); the issue is not listed in CISA KEV and active exploitation is not confirmed.

Grafana OSS and Grafana Enterprise 13.2 installations that have explicitly enabled the experimental kubernetesSsoSettingsApi feature toggle let any authenticated user read SSO client secrets and modify instance-wide SSO configuration, because the SSO settings endpoints are missing an authorization check (CWE-285). Default deployments are not exposed, since the toggle ships disabled, and an attacker needs a valid Grafana account but not the SSO-settings permission that should normally be enforced. No public exploit code or confirmed active exploitation has been identified at time of analysis; the Grafana security advisory is the authoritative reference for fixed releases and any interim guidance.

Apache Kafka brokers that have an authorizer enabled will read a file or environment variable from the broker host and return its contents to any authenticated principal, including one holding no ACL grants at all - not even ALTER_CONFIGS. The flaw is a missing-authorization ordering problem (CWE-862): an IncrementalAlterConfigs or AlterConfigs request aimed at a BROKER resource reaches configuration validation, which resolves ${file:/path:key} or ${env:VAR} variables through a ConfigProvider instantiated from the request, before any authorization check is applied, and a type-validation error reflects the resolved secret back to the caller. This defeats the org.apache.kafka.automatic.config.providers allowlist introduced for CVE-2024-31141, but the read is bounded by the broker process's OS file permissions and impacts only confidentiality, not cluster availability or data integrity; there is no public exploit identified at time of analysis and the vendor-supplied fix set is Kafka 4.2.2, 4.3.2, and 4.4.0.

Jenkins core 2.587 and earlier and Jenkins LTS 2.580.1 and earlier are covered by the vendor's 2026-10-28 security advisory, which bundles fixes for several distinct flaws into Jenkins 2.588 and LTS 2.580.2; the identifier CVE-2026-117624 does not appear anywhere in the supplied advisory text, so its specific defect, prerequisites and severity could not be verified from the available sources. The sibling issues that are described are not anonymously reachable - they require an authenticated account plus a Jenkins permission such as Overall/Read, Item/Configure, View/Configure, Agent/Configure or Item/Create - and several of them can end in code execution in the controller JVM or in cross-site scripting. No public exploit code and no CISA KEV entry were identified for this identifier, no EPSS score was supplied, and the priority label is awaiting_data; the vendor advisory at https://www.jenkins.io/security/advisory/2026-10-28/ is the authoritative reference.

Juniper Networks Session Smart Router exposes an insecure endpoint that runs as root and performs no authentication check, letting a remote attacker who can reach it obtain administrative privileges by passing crafted URL parameters. Per the CVSS vector the attack is network-reachable, unauthenticated (PR:N) and requires no user interaction, so severity is rated 9.8 - but exploitability is gated by deployment state: only devices that have not yet been onboarded to Mist or Conductor are exposed, and the endpoint becomes unreachable once onboarding completes. No KEV listing or public exploit reference appears in the supplied intelligence, so no public exploit identified at time of analysis; the vulnerability is nevertheless tracked as act_now priority because of the pre-auth root-level impact within the pre-onboarding window.

Cross-tenant IDOR and missing function-level authorization in YosemiteCrew allow any registered platform user - down to a self-registrable patient or companion-app account - to modify or delete another organization's FHIR service catalogue and PMS task-library/template definitions, with service records additionally readable with no authentication at all. The exposed routes (PATCH and DELETE on /fhir/v1/service/:id, PUT on /v1/task/pms/library/:libraryId, and the PMS template create, update and delete routes) carry only authorizeCognito, while sibling create routes already enforce withOrgPermissions() and requirePermission(...), and the service layer resolves records by global ID without an organisationId filter. Vendor-released patch: none identified at time of analysis - the issue is confirmed at main/dev commit bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57 with no fix queued, and no public exploit code was identified at time of analysis.

Broken object-level authorization in Xibo CMS 4.4.2 and earlier allows a logged-in user to point PUT and DELETE requests at /action/{id} and modify or delete Layout actions attached to any Layout in the CMS, not just their own. The CVSS vector confirms the attacker must be authenticated (PR:L) but needs no user interaction; the vendor notes the only required privilege - permission to edit, including delete, all created Layouts - is granted to non-administrators as standard, so ordinary accounts typically qualify. Integrity impact is high with a limited availability impact, confidentiality is unaffected, and there is no public exploit code identified at time of analysis; the vendor has released 4.4.3 and this is scheduled as this-week remediation rather than an emergency.

Missing authorization in NORA Registry (nora-registry) 0.9.4 and earlier lets any valid read-scoped bearer token enumerate token metadata - ID, owner, role, description, expiry and last-use - for every user through the globally scoped token-management list endpoint, while a write-scoped bearer token or write-capable OIDC workload identity can additionally revoke arbitrary admin and service tokens by ID, disrupting the registry and forcing credential recovery. The flaw is CWE-862: auth_middleware() authenticates /ui/tokens and /api/ui/tokens but only checks role.can_write() instead of role.can_admin(), so the handlers operate across all accounts. No CISA KEV entry or confirmed active exploitation was reported; the vendor advisory includes reproduction steps (a PoC reference) rather than verified working exploit code, and exploitation requires auth to be enabled, the token endpoints to be network-reachable, and the attacker to already hold a valid registry credential.

Missing authorization in the iHomefinder Optima Express (MarketBoost IDX) WordPress plugin, affecting all versions through 9.0.0, lets remote attackers without credentials reach plugin functionality that should be access-controlled and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms a network-reachable, low-complexity, unauthenticated issue whose impact is confined to confidentiality, with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the specific plugin feature or endpoint that must be reachable is not described in the available sources, leaving an active installation of an affected version as the only firm precondition.

Unauthenticated remote file upload and direct retrieval weaknesses in HCL BigFix AEX allow attackers to place files on the server and then access or download uploaded content without proper authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows the issue is reachable over the network at low complexity with no authentication or user interaction, and the supplied CPE identifies the affected product without a narrower version boundary. No CISA KEV entry or public exploit was identified at time of analysis, but the issue is assessed as a credible high-priority item to address this week rather than an emergency.

Remote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector requires a high-privilege account (PR:H), so an attacker must already hold privileged access to the product before exploiting the code-injection flaw (CWE-94). The scope change (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component, with high confidentiality, integrity, and availability impact. No public exploit has been identified at the time of analysis, and the vendor advisory KB0134281 is the primary reference; the vuln.today decision label is act_now.

XFS group-quota enforcement in the Linux kernel can be bypassed by an authenticated user who belongs to multiple groups, allowing a file's group ID change to evade quota accounting and exceed a group hardlimit. The flaw is a credential-check semantics regression introduced in Linux 5.18 and notably reachable through NFS clients; EPSS is 0.18% (8th percentile), no public exploit or KEV entry is present in the supplied data, and vendor fixes exist in 6.18.59, 7.2.13, and 7.3. The assessed vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, so real-world priority is moderate despite the 8.2 base score, and the kernel update should be scheduled this week.

Dell PowerProtect Data Domain Management Center enforces incomplete authorization checks, letting a low-privileged authenticated user perform operations they should not be permitted to carry out, with high integrity impact and limited availability impact and no confidentiality impact (CVSS 7.1). Exploitation requires a pre-existing low-privileged account on the management appliance plus network reachability; an unauthenticated outsider cannot trigger it directly, and the sources do not identify which specific management feature or endpoint lacks the check. No KEV entry, no SSVC emergency flag and no public exploit reference are present - no public exploit identified at time of analysis - but a patch is available from Dell and the release is prioritised as a near-term (this week) patching item rather than an emergency.

SQL injection in Dell PowerProtect Data Domain Management Center allows a remote attacker holding a low-privileged authenticated session to execute arbitrary SQL within the console and, because the assessed scope is changed (S:C), cross the console boundary to gain unauthorized access to the managed Data Domain systems. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and is tracked with an act_now priority. No public exploit code was identified at time of analysis and there is no CISA KEV entry, but vendor fixes are available and the required credentials are the only barrier, so consoles reachable from untrusted networks should be updated promptly.

Improper authentication in Dell PowerProtect Data Domain allows a remote attacker who already holds low-privileged credentials to bypass protection mechanisms, with high impact on confidentiality and integrity and limited impact on availability (CVSS 3.1 score 8.3, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit code or confirmed active exploitation is identified in the available data, and the flaw is tracked as a this-week priority rather than an emergency; the prerequisite is an existing low-privileged foothold on the appliance rather than unauthenticated access.

Missing authorization in Dell PowerProtect Data Domain Management Center (DDMC) allows an authenticated low-privileged, network-positioned user to invoke operations that should be restricted, with high integrity and availability impact on managed Data Domain systems and no confidentiality impact. The affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the CVSS 3.1 score is 9.6 with scope changed. No public exploit identified at time of analysis, and the vulnerability is prioritized act_now.

The Java RMI service exposed by Tactis NoviGest Desktop App accepts remote method invocations on critical functions without verifying the caller, letting a network-positioned attacker reach stored credentials and issue arbitrary SQL against the application's PostgreSQL backend. Because the database account the application uses is described as holding elevated privileges, the SQL access can be chained into operating system command execution on the server, taking over confidentiality, integrity and availability. The defect is rated 9.4 under CVSS 4.0 and flagged act_now by vuln.today based on severity and breadth of impact, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the practical barrier is network reachability to the RMI port, since a service bound to localhost or shielded by firewall rules is not remotely abusable. Note that the authentication requirement is not consistently described across sources - the narrative states critical RMI methods lack authentication, while the CVSS 4.0 vector asserts PR:L - so the exact precondition should be confirmed with the vendor.

Stack-based buffer overflow in Dell PowerProtect Data Domain allows a low-privileged authenticated remote attacker to potentially gain unauthorized access and affect confidentiality, integrity, and availability. The flaw affects Feature Release versions 7.7.1.0 through 8.8 and the listed LTS2024, LTS2025, and LTS2026 ranges; exploitation requires network reachability to an affected service plus valid low-privileged credentials, so it is not exploitable by a fully unauthenticated attacker. No CISA KEV entry or public exploit is identified at time of analysis, and the vuln.today decision is this_week, a non-emergency prioritization.

Unauthenticated remote attackers can create privileged accounts on Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20, potentially taking complete control of the system. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-862 missing authorization, with the vendor describing it as an improper authentication issue leading to privileged account creation. No public exploit code has been identified in the supplied intelligence at time of analysis, but the vuln.today decision label is act_now and Dell recommends upgrading at the earliest opportunity.

Improper authentication in Dell PowerProtect Data Domain allows remote unauthenticated attackers to bypass authentication and execute arbitrary commands with root privileges, giving complete control of the appliance. Affected systems are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit has been identified at time of analysis, but the CVSS vector indicates no privileges or user interaction are required; exploitation is limited by whether an attacker can reach the appliance's remotely accessible interface.

Dell PowerProtect Data Domain Management Center can be coerced into granting elevated privileges to a remote attacker who already holds a low-privileged authenticated account, because the product performs an authentication decision on a spoofable identity attribute rather than a verified one. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The impact does not stop at the management appliance: the scope change in the assessed vector (S:C) reflects that a successful escalation can reach other managed Data Domain systems, and vendor-published fixes exist, so the priority decision is act_now; no public exploit code and no CISA KEV entry were identified at time of analysis.

Information disclosure in the Animated Text Block WordPress plugin (versions up to and including 1.2.6) allows an authenticated user with Contributor-level access or higher to read the rendered content of any published post on the site. The 'animated-text' shortcode handler accepts an attacker-supplied post ID and, in its 'publish' branch, renders the post without any capability check and without verifying that the post type is the plugin's own custom post type or is otherwise viewable - so posts in non-public custom post types (public=false, show_in_rest=false) that WordPress normally hides from direct URLs and the REST API can be disclosed. Impact is confidentiality-only (no modification or denial of service), the target post must be in 'publish' status, and no public exploit code or PoC reference is present in the available sources; the vuln.today decision label is this_week.

Unauthenticated WordPress account takeover in the Jupiter X Core plugin (all versions up to and including 4.61.0) allows a remote attacker to be logged in as the site's administrator through the Raven forms Twitter/X social login handler. After exchanging the visitor's oauth_verifier for an access token, the handler never calls setOauthToken() to rebind the TwitterOAuth client, so the follow-up account/verify_credentials call is still signed with the site operator's stored Access Token and Secret; the plugin then resolves a local WordPress user by the X application owner's email and issues a session with wp_set_auth_cookie(). Exploitation requires that the Twitter/X social login feature be enabled and configured with the operator's X credentials, but once it is, the attack needs no authentication and no user interaction (CVSS 3.1 base 9.8, decision label act_now); no public exploit was identified at time of analysis.

Google Chrome builds prior to 156.0.8078.73 contain a Forms access-control flaw that allows a remote, unauthenticated attacker to bypass web origin policy when a victim opens a crafted HTML page. Per the assessed CVSS vector, the bypass crosses a security scope and affects confidentiality and integrity, while availability is not impacted; the required user interaction is the main gating condition and default configurations are affected. No public exploit identified at time of analysis, and no CISA KEV listing is present; EPSS is 0.19% (9th percentile) while the vuln.today priority label is act_now, so remediation should be treated as urgent.

Missing authorization in Google Chrome's Video component before 156.0.8078.73 allows a remote attacker to bypass the web origin policy when a victim renders a crafted HTML page, carrying a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Google rates the Chromium security severity High and provides a stable-channel fix; the supplied intelligence shows vendor patch availability, a vuln.today decision label of act_now, an EPSS score of 0.19% (9th percentile), and no public exploit identified at time of analysis.

Type confusion (CWE-843) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitrary code in the browser when a victim loads attacker-controlled web content, as reflected by the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector (8.8 High). Affected builds are those below 154.0.4258.48, and the flaw is delivered through drive-by or social-engineering browsing rather than unattended remote exploitation because user interaction (UI:R) is required. This is a genuine prioritization candidate for this week's patch cycle but not an emergency; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.

Sunhillo SureLine deployments running versions 8.0.0 through below 9.1.5 accept session cookies that contain nothing but a cleartext username, letting an unauthenticated remote attacker impersonate a logged-in user and chain that access into root command execution through networkDiag.cgi. The main limiting prerequisite is that the targeted account must already hold an active web session at attack time, and default account names such as Admin or sftp_user make the username guesswork trivial. The vendor has released SureLine 9.1.5 as the fix and prioritization guidance marks this as act_now; no CISA KEV listing or verified working exploit code is present in the available data.

Unauthenticated remote file read in Sunhillo SureLine before 9.1.5 exposes sensitive system files, including /etc/shadow, the web user database, the root SSH private key, and the device TLS private key. The radarUpdater.cgi endpoint lacks authentication checks and does not sufficiently sanitize the filename parameter, allowing directory traversal sequences to read arbitrary files with root privileges. SureLine versions 8.0.0 up to but not including 9.1.5 are affected; a vendor patch is available, and no public exploit was identified at time of analysis.

Member-only content gated by the MembershipWorks plugin for WordPress before 6.17 can be retrieved by unauthenticated visitors through the WordPress REST API, exposing posts and pages the plugin is meant to hide from non-members. The plugin's protected-content filter is only registered during normal front-end request handling, so REST responses return the raw rendered content instead of the stripped version; no authentication or user interaction is required, and only confidentiality of the gated content is affected (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 8.7). No public exploit code has been identified at time of analysis, and the practical impact depends entirely on whether the site actually uses MembershipWorks content protection; sites in that configuration should plan to update this week.

Arbitrary code execution in Adobe Campaign Classic (versions 0 through 7.4.4 build 9402) stems from incorrect authorization that lets a low-privileged, authenticated attacker run code in the context of the current user, with no user interaction required. The CVSS 9.9 score reflects a scope change (S:C), meaning the impact crosses a security boundary beyond the vulnerable component, and the only real prerequisite is a valid low-privilege account on a network-reachable ACC instance. No public exploit has been identified at time of analysis, but the issue carries an act_now priority, so exposure should be treated as urgent wherever ACC is reachable by untrusted networks or widely provisioned with low-privilege users.

Authlib 0.15 through 1.9.0 can let a party holding any valid RFC 7592 registration access token read, modify, or delete a different client's registration record, because the library's documented example implementations of ClientConfigurationEndpoint.authenticate_client and check_permission never bind the presented token to the target client. The exposure is conditional: it applies to deployments that expose the ClientConfigurationEndpoint and implemented those two methods by copying the shipped docstring examples, which resolve the target from the request-supplied client_id and check only client.editable. Exploitation is authenticated (CVSS PR:L - a valid registration_access_token is required) and also needs the victim's client_id, but under the common open/anonymous RFC 7591 self-registration model an attacker can self-issue a qualifying token for free, after which redirect_uri rewriting enables authorization code or token interception and deletion causes denial of service. Authlib 1.9.1 fixes the flaw; no public exploit was identified at time of analysis, and the overall signal is a conditional this-week remediation priority rather than a mass-exploitation emergency.

Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.

Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.

Unauthenticated handling of FireCluster Sync traffic in WatchGuard Fireware OS lets an attacker who already holds a position on the cluster interconnect - a compromised cluster peer or an on-path attacker on the synchronization network - invoke privileged firewall management actions as root with a single crafted request, with no credentials or user interaction required. The flaw affects the Fireware OS 12.0 branch before 12.12.4, the 2025.1 branch before 2026.4, and the 12.0 branch before 12.5.22; Fireboxes that are not running FireCluster are not exposed through this path, which together with the typically isolated nature of the cluster interconnect is the main gating factor on real-world risk. Vendor patches are available on all three branches, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-reported CVSS of 9.4 and adjacent-network reachability warrant prompt remediation on clustered deployments.

Missing authentication in the Fireware OS FireCluster synchronization daemon lets remote, unauthenticated attackers invoke privileged system-level administrative actions on WatchGuard firewalls where clustering is enabled, by sending a specially crafted request to the FireCluster management IP. Only appliances actively running FireCluster are exposed, and exploitation additionally requires network reachability to that management IP; single-appliance deployments that do not run FireCluster are not affected. No public exploit code identified at time of analysis, but the vendor self-reported the flaw at CVSS 9.2 with confirmed fixes in every affected branch, and it is prioritized act_now.

Password-protected link shares in the 3D Viewer for Nextcloud app (versions 1.7.9 through 3.3.1) can be read without any password or session by anyone who knows the share token, via GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}. The app's public controller was not a Nextcloud PublicShareController, so the framework's PublicShareMiddleware returned early and never enforced the share password, expiry, or share type; requests returned 200 with the full file body for shares whose normal Nextcloud share page still prompted for a password. Exposure is limited to files in the 3D formats the app handles (STL, GLB/glTF, OBJ, STEP, IFC and similar); non-3D files in the same share are unaffected and expired shares return 500 rather than leaking content. No public exploit code was identified at time of analysis; the vendor fixed the issue in 3.3.2.

Local privilege escalation in TeamViewer Remote Management Monitoring for Windows before 26.10.1: a low-privileged authenticated local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. Only hosts with the Remote Management Monitoring component installed and its service running are affected (base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by available data), and exploitation requires an existing low-privilege local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). This is a credible but non-emergency issue - no public exploit code or active exploitation is confirmed, and the vendor has released a fixed version (26.10.1).

Local privilege escalation in TeamViewer Full Client and Host (prior to 15.83) and the Remote Management - Monitoring component (prior to 26.10.1) allows an authenticated low-privileged local user to execute scripts as SYSTEM/root by abusing improper access control on the IPC channel between the client/host and the monitoring component. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful abuse gives full confidentiality, integrity and availability impact on the affected host, but requires the attacker to already hold a valid low-privileged local account and presumes the Remote Management - Monitoring component is deployed. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; vendor-released fixes exist (15.83 for current Full Client/Host branches, 15.64.10 for legacy Windows 7/8 builds, and 26.10.1 for Remote Management - Monitoring) per TeamViewer bulletin TV-2026-1012.

Improper authentication in OAuthLib's RFC 8628 device authorization grant allows a remote caller to obtain a bearer token without ever presenting a valid device_code. The token endpoint accepts any value (or none) in the device_code parameter because DeviceCodeGrant.validate_token_request performs no validation of it, so anyone who knows a client_id registered for the device_code grant can mint a token for that client. Affected are Python projects using oauthlib 3.3.0 through pre-4.0.0 that expose the device workflow at their token endpoint; the vendor-released fix is 4.0.0. No public exploit tooling or active exploitation is confirmed, and the advisory's reproduction scenario additionally depends on the integrator's RequestValidator.authenticate_client accepting public clients, a behavior tied to separate oauthlib issue #919.

Protection-mechanism bypass in Dell PowerProtect Data Domain Virtual Edition allows a remote attacker who already holds a high-privileged (administrative) account to subvert the appliance's data-protection controls. Affected builds are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.70, LTS2025 8.3.1.0 through 8.3.1.30 and LTS2026 8.6.1.0 through 8.6.1.10; the flaw is scored CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with the PR:H metric confirming the administrative precondition, which sharply limits the realistic attacker set to insiders or adversaries who have already compromised privileged credentials. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and vendor patches are available, so this is a scheduled-patching item rather than an emergency.

Electrum's built-in Nostr Wallet Connect plugin can be driven past the user's configured daily_limit_sat, letting an untrusted or compromised NWC client spend more of the wallet's Lightning balance than policy allows. All versions from 4.6.0 (where the plugin was introduced) through 4.7.1 are affected; 4.7.2 is the fixed release. Two trigger paths exist: concurrent pay_invoice requests that both clear budget_allows_spend() before add_to_budget() records the spend (CWE-367), and repeated sub-satoshi millisatoshi amounts that are floored to a smaller whole-satoshi figure during budget accounting. Exploitation requires an authenticated NWC connection issued by the user, the plugin enabled (it ships default-disabled) and a spending limit configured; no public exploit identified at time of analysis, and the vuln.today decision label is act_now.

Unauthenticated attackers can forge valid administrator JSON Web Tokens against nest-admin before 1.0.1 because the JWT signing secret (and the refresh-token secret) is committed to the repository as the fixed placeholder value 'admin!@#123'. Any deployment still running with the shipped .env.production or .env.development secret is fully compromised: an attacker signs a token asserting any user ID or the admin role, and JwtStrategy and RbacGuard accept it without further checks, yielding complete confidentiality, integrity and availability impact (CVSS 4.0 base 9.3, assessed CVSS 3.1 9.3, CWE-321). No public exploit code has been identified at time of analysis, although the key material itself is publicly readable in the project's Git history; VulnCheck assigns an 'act_now' priority, and the sole limiting factor is whether an operator replaced the committed secret with an independent strong value. The vendor fixed the issue in 1.0.1 and states that any environment that ever ran with the historical default must rotate both secrets and reissue all sessions after upgrading.

Back-office account takeover in Umbraco CMS (all versions before 17.7.2 and 18.0.0 through 18.2.1) lets unauthenticated attackers poison the Host header to register attacker-controlled OAuth redirect URIs for the back-office OpenIddict clients, then send a signed-in back-office user an authorization link using response_mode=form_post so the authorization code is delivered to the attacker, who redeems it with HTTP Basic client credentials. A successful chain yields an authenticated back-office session with the victim's privileges - full site control, and code execution through Razor templates if the victim is an administrator. Exploitation is conditional: it only works where the web server, IIS without host-name bindings, or a reverse proxy forwards requests for unrecognised host names to Umbraco, and it requires a logged-in operator to open the attacker's link (CVSS 3.1 AV:N/AC:H/PR:N/UI:R, vendor CVSS 4.0 7.7); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patches exist in 17.7.2 and 18.2.2.

Authentication bypass in Keepnet Labs Agentic AI / Agentic Ally lets a network-reachable, unauthenticated attacker spoof an identity and reach functionality that should require authentication, with a high confidentiality impact and no stated integrity or availability effect (CVSS 3.1 base 7.5, CWE-290). Every deployment running a build before commit 0ef61f2e is affected, and the practical exposure is bounded by how widely this niche product is deployed and internet-facing rather than by any attacker prerequisite. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor has published a fix point at commit 0ef61f2e, and the vulnerability is prioritized as this_week.

The missing-authentication flaw in NVIDIA NeMo Agent Toolkit 1.0 through 1.8.0 leaves a critical toolkit function without a credential check, giving unauthenticated network attackers a path whose rated consequences include code execution, privilege escalation, data tampering, denial of service, and information disclosure. CVSS is 10.0 with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and the vuln.today priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV entry appears in the supplied data; network reachability of the toolkit interface is the main practical exposure constraint, and upgrading past 1.8.0 is the vendor-directed remediation.

Unauthenticated arbitrary file read in Hitachi Energy TRO600 Series firmware 9.0.0.0 through 9.1.1.0 lets remote attackers with network reachability to the device's management interface disclose sensitive files, including configuration and password data. The flaw is a missing-authentication condition (CWE-306) with confidentiality-only impact, and the available intelligence does not confirm active exploitation; no public exploit identified at time of analysis. Risk is real within the product's deployment niche but bounded by footprint and exposure.

Authenticated users of Hitachi Energy TRO600 series devices can abuse the product's port-forwarding capability to reach services that are bound only to localhost, bypassing the network access restrictions that are supposed to keep those services unreachable from the network. Successful tunnelling gives the attacker access to sensitive local functionality and confidential information, and the flaw also carries an availability impact; all firmware versions from 9.0.0.0 through 9.2.1.6 are listed as affected. Exploitation requires a valid authenticated session (CVSS PR:L) and conditions outside the attacker's full control (AC:H, AT:P), no public exploit has been identified at time of analysis, and the vendor's priority guidance places this in the moderate, address-this-week band rather than an emergency.

Unauthenticated attackers can force the temporary-login secret in REDAXO core's bundled structure/history plugin (5.3.0 through 5.21.3) into a predictable state and then forge a login token that yields a backend session for any existing account, including an administrator. On installations that are not running in live mode, that backend access escalates to remote code execution via PHP introduced through templates, modules, actions or add-on installation; in live mode the bypass and backend compromise still occur but the RCE pivot does not apply. Exposure is limited to installations where the structure/history plugin is installed and activated, since it is not enabled by default, and no public exploit code was identified at time of analysis; the vendor fixed the flaw in 5.21.4.

Broken access control in REDAXO core before 5.21.4 allows an authenticated editor to redirect slice write operations at content they are not permitted to change, by pairing an article they are allowed to edit with the id of a slice belonging to another category. Deleting and toggling other editors' slices online/offline require the fewest additional permissions, while moving them needs the global moveSlice[] right and overwriting content additionally requires a matching module/template constellation. This is a moderate-priority, authenticated authorization flaw rather than a widespread emergency: exploitation needs a valid editor session with content permission on at least one category, no public exploit code has been identified at time of analysis, and the vendor has released REDAXO 5.21.4 as the fix.

Missing authorization in REDAXO's media pool bulk move (core releases through 5.21.3) lets authenticated backend users with permission for just one media category pull files out of categories they are barred from and then silently replace their contents everywhere those files are embedded. The bulk move validates only the target category, and because media permissions are flat while search (notably searchmode=global) lists files outside permitted categories as selectable checkboxes, no crafted request or victim interaction is required. Integrity impact dominates: replacement is constrained by matching file extensions, a MIME allowlist and SVG sanitisation, and deletion of in-use files is refused. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and vendor patches are available in 5.21.4, making this a this-week priority rather than an emergency.

Missing authorization in REDAXO core before 5.21.4 lets any authenticated backend user read the unpublished working version of any article by sending rex_version=1 to the structure/version preview, and lets users holding the history[article_rollback] permission read historic snapshots, including content that has since been deleted, through the structure/history preview using rex_history_date. Impact is confidentiality only; the article and clang are taken from freely chosen request parameters and can be enumerated, so exposure is systematic rather than a single object. No public exploit code has been identified at time of analysis, and the vendor-released fix is version 5.21.4.

Missing authorization in the REDAXO backup addon's database export (core versions up to and including 5.21.4) lets a non-admin user who has been granted the backup[export] role permission export any table in the database, including rex_user, rex_user_session, rex_user_passkey and tables belonging to other applications sharing the same database. Because rex_user_session stores session IDs and stay-logged-in keys in plaintext, such a user can impersonate any account with an active session or persistent login - including administrators - and rex_user exposes password hashes for offline cracking, escalating the attacker from a limited role to full admin control. Exploitation is gated on an administrator explicitly delegating backup[export] to a non-admin account (by default only admins reach the backup addon), and full session-based takeover additionally requires a victim admin to have a live or stay-logged-in session; no public exploit code was identified at time of analysis, and the vendor fixed the issue in 5.21.5.

Eaton easyE4 controllers before version 2.46 reuse a static nonce during authentication, allowing an attacker who can capture a legitimate authentication exchange to replay it and gain unauthorized access to the device. The CVSS 3.1 score is 7.5 (AV:N/AC:H/PR:N/UI:R), reflecting that exploitation depends on a real login occurring and being observed on the control-network path; no public exploit code or CISA KEV entry was identified at time of analysis. Eaton has released a fix in easyE4 2.46.

Authentication bypass in Hitachi HiRDB Server (CWE-290, spoofing) lets a remote attacker who can reach the database service impersonate a trusted party and slip past authentication, with maximum impact on confidentiality, integrity and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All five listed build lines are affected: Server Version 10 (10-00 before 10-12-01), Version 9 and Version 9(32) plus their 'with Additional Function' variants across the 09-00/09-02 to 09-66 branches. Exploitation is unauthenticated and needs no user interaction, so real-world risk is governed mainly by whether the HiRDB listener is reachable from untrusted networks; EPSS is low at 0.64% (51st percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix and the case is triaged act_now, so exposure should be checked rather than assumed benign.

Unauthenticated network attackers can invoke a critical HiRDB Server function without an authentication check, exposing affected Hitachi HiRDB Version 10 and Version 9-family deployments to high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is CWE-306 and is reachable over the network with no privileges or user interaction; Hitachi reports a vendor patch and the vuln.today decision is act_now, while EPSS is 0.61% (49th percentile). No CISA KEV status is provided, and no public exploit identified at time of analysis; Version 10 is fixed in 10-12-01, while the supplied data does not name fixed builds for the Version 9, Version 9(32), or 'with Additional Function' branches.

Authentication bypass in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 up to but not including 13-50-31) lets remote attackers reach the management service without credentials and, per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), potentially take full control of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, while EPSS is modest at 0.64% (51st percentile) and it is not in CISA KEV; no public exploit code has been confirmed. Exposure is greatest where the JP1/AJS3 Manager service is reachable from untrusted networks, since it is normally an internal management server.

Missing authorization in the Balbooa Gridbox extension for Joomla (versions 1.0.0 through 2.20.4.1) allows unauthenticated remote requests to invoke the EditorController::getBlogPosts() task and read blog-post data without the edit-level check applied to other controller tasks. The supplied CVSS 4.0 score is 9.3 with high confidentiality, integrity, and availability impact, but the independent assessment is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so the demonstrated impact should be treated as unauthorized blog-post read or exposure rather than data modification or denial of service. No public exploit was identified at time of analysis; EPSS is 0.32% (24th percentile), the fixed release is 2.20.4.2, and the vuln.today decision label is act_now despite the independent assessment noting conflicting signals.

A missing authorization check in the Google Compute Engine disks.createSnapshot and regionDisks.createSnapshot APIs let an authenticated Cloud principal request a snapshot of a disk belonging to a different project, exposing cross-project disk data. Google remediated the flaw server-side on 31 August 2026 and states no customer action is needed, so current deployments are not exploitable; the exposure window is historical, covering Compute Engine use before that date. Confidentiality impact is high (disk contents could be read) but integrity and availability are unaffected, and no public exploit code or active exploitation has been identified at time of analysis, with an EPSS score of 0.35% (29th percentile).

Authentication bypass in the Qode Membership plugin for WordPress, in all versions up to and including 2.0.6.2, lets unauthenticated attackers log in as any existing account, including Administrator accounts, by posting a known or enumerated WordPress login username to the qode_membership_check_facebook_user AJAX action. A typographic error in the Facebook OAuth guard (testing $check_social_useqoder instead of $check_social_user) makes empty() always evaluate true, so the Graph API token-verification branch is dead code and wp_set_auth_cookie() is reached with no credential or token validation. Exploitation requires a valid qode_validate_facebook_login nonce, which is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without authentication; no public exploit code was identified at time of analysis, EPSS is 0.37% (30th percentile), yet the vuln.today decision label is act_now given automatable exploitation and total technical impact.

Authenticated IPMI administrators on Supermicro MBD-X12SPI BMC firmware 01.07.20 can read and write arbitrary physical memory, leading to code execution on the BMC operating system. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified CWE-287; exploitation requires valid IPMI Administrator credentials and network access to the BMC management interface. No public exploit code has been identified at time of analysis, EPSS is 0.32% (24th percentile), and the vuln.today priority is this_week, so this is a moderate, authentication-gated risk rather than an emergency.

Unauthenticated remote attackers who can reach the Supermicro X12SPI BMC's IPMI interface may be able to bypass integrity and encryption enforcement and execute arbitrary commands against an active IPMI session. The flaw is rated CVSS 9.8 (CWE-306), but exposure is limited by the need for network reachability to the BMC management interface and an existing active session. The vuln.today decision label is act_now, while EPSS is 0.40% (34th percentile) and no CISA KEV entry or public exploit was identified in the provided data.

Supermicro's X12SPI BMC firmware (01.07.20) does not enforce the integrity and encryption requirements it is supposed to apply to IPMI commands, so an attacker who can reach the management interface can craft packets that execute arbitrary commands inside an already-active IPMI session. The CVSS vector is unauthenticated (PR:N), but exploitation is conditional: the BMC must be network-reachable and a live session must already exist for the attacker to act against, which is why the assessed severity combines high confidentiality, integrity and availability impact with high attack complexity. There is no KEV listing, EPSS is 0.34% (27th percentile) and no public exploit code was identified at time of analysis; the vuln.today decision label is this_week, a genuine but non-emergency priority.

Authentication bypass in Kener 3.0.0 through 4.1.9 lets unauthenticated remote attackers who know an administrator's email address forge a kener-user JWT session cookie and reach /manage/api with full administrative privileges, and also forge password-reset tokens, because the application silently falls back to the hardcoded string 'DUMMY_SECRET' when KENER_SECRET_KEY is empty or unset. The flaw is conditional rather than universal: the assessed vector is AC:H/AT:P precisely because any instance configured with a strong, unique KENER_SECRET_KEY rejects the forged token, so only default or misconfigured deployments are exploitable - but those deployments are fully compromised with no credentials and no user interaction. No public exploit code is confirmed at time of analysis and there is no KEV listing; EPSS is 0.62% (50th percentile), which understates the risk for unhardened instances, and the vendor priority label is act_now.

A local privilege-escalation flaw in Apple macOS allows an application running with low privileges to execute arbitrary code with system privileges, due to a missing authorization check (CWE-862). All macOS branches before Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2 are affected; Apple fixed the issue with improved access control in those releases. Exploitation requires the attacker to already be running a malicious or compromised app locally (AV:L, PR:L) with no user interaction needed, and there is no public exploit identified at time of analysis (EPSS ~0.26%, not in CISA KEV, SSVC exploitation: none).

Cross-namespace authorization bypass in HashiCorp consul-k8s 0.42.0 and later can let an attacker with an existing low-privilege authenticated foothold obtain elevated Consul privileges through component ACL binding rules; deployments not using those rules or running releases before 0.42.0 are outside the stated affected scope. The flaw is fixed in consul-k8s 2.1.0 and 1.8.18, and no public exploit was identified at time of analysis, but the 9.9 CVSS score and act_now priority support prompt remediation.

Missing authentication in OmniRoute 3.8.50 through 3.8.51 lets an unauthenticated remote caller POST to /api/sync/tokens and mint a sync token whenever the instance runs in open mode (requireLogin=false), then spend that token against GET /api/sync/bundle to pull decrypted provider credentials and plaintext API keys - the same material /api/settings/export-json already denies to anonymous callers. The flaw is conditional: when login is enabled (the default), token issuance already required a dashboard session or the local CLI, so only open-mode deployments are reachable, which is why the assessed CVSS:3.1 vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact (C:H/I:N/A:N) even though the vendor's CVSS:4.0 score is 8.2. Tokens minted this way were recorded as issuedBy:"open" and kept opening the bundle after login was re-enabled; version 3.8.52 fixes issuance, routing /api/sync/tokens into the always-protected tier and refusing the legacy "open" tokens. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV; priority is this_week.