Authentication Bypass

Hard-coded credentials in Dell OpenManage Server Administrator (OMSA) managed-node builds before 11.1.0.3 let an unauthenticated remote attacker reach the management service and log in with credentials baked into the product, bypassing authentication entirely (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Affected builds are the Windows managed-node patch package and the RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed-node packages; exploitation needs only network reachability to the OMSA service, but in practice those interfaces are usually confined to internal management networks, so internal and lateral exposure is the more realistic path. Exploitation status: no public exploit identified at time of analysis (CISA SSVC records Exploitation: none), and EPSS is low at 0.31% (24th percentile); a vendor patch exists in version 11.1.0.3, which removes the condition outright, so the residual risk is driven by unpatched, network-exposed OMSA instances rather than by observed attack activity.

Use of a hard-coded cryptographic key in Dell OpenManage Server Administrator (OMSA) Managed Node builds prior to 11.1.0.3 means an unauthenticated remote attacker who can reach the OMSA management service may recover the statically embedded key shared by every installation and leverage it to bypass authentication for unauthorized access to managed nodes. Affected builds are the Windows managed-node patch and the RHEL 8.10, RHEL 9.4, SLES 15 and Ubuntu 22.04 packages, all of which are fixed in vendor version 11.1.0.3. Exploitation has not been confirmed in the wild (no CISA KEV listing), CISA's SSVC decision framework rates the issue as not automatable with no observed exploitation, and EPSS is low at 0.38% (32nd percentile), while the assessed CVSS of 9.8 reflects full confidentiality, integrity and availability impact if the flaw is successfully abused.

AVideo's PGP second-factor verification can be bypassed, allowing an attacker who already holds a victim's password to complete authentication without ever supplying a valid PGP challenge response. The LoginControl component's verifyChallenge.json.php endpoint compares the submitted response against an uninitialized session variable using PHP loose equality, so a single parameter-less GET request evaluates null == null and marks the login fully authenticated; EUVD tracking places the affected range at AVideo 0 through 29.0. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack needs only one unauthenticated-to-the-endpoint network request with no user interaction, and the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, making it a high-priority authentication bypass wherever PGP 2FA is the sole remaining protection and credential theft or reuse is feasible.

Unauthenticated remote code execution is possible against Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3, where a critical management function can be invoked without any authentication check (CWE-306). Affected deployments include the Windows managed-node patch plus managed-node builds for RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04, and an attacker who can reach the OMSA management interface from the network needs no credentials and no user interaction (CVSS 8.1, PR:N/UI:N), though the AC:H rating indicates the exploit path depends on conditions outside the attacker's control and is not a simple one-shot request. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so real-world risk is currently gated mainly by whether OMSA is exposed beyond a trusted management VLAN rather than by known exploitation.

SAML SSO authentication bypass in SUSE NeuVector lets anyone who legitimately holds an account on another application behind the same corporate identity provider log into NeuVector without ever having been granted a NeuVector account. NeuVector's SAML service provider handler never validates the assertion's <Audience> element, so a bearer assertion minted for a wiki, ticketing system, or expenses tool is accepted verbatim; the internal NotInAudience warning is produced but never read, which is the CWE-287 improper-authentication root cause. Exploitation is not free - it requires SAML authentication to be enabled against an IdP shared with at least one other relying party and valid credentials in that same federation (PR:L, AT:P) - but it needs no NeuVector account, no admin rights, and no victim interaction, and it yields high confidentiality and integrity impact; there is no public exploit identified at time of analysis and no CISA KEV entry, so this is a high-priority authentication defect rather than a confirmed actively exploited one.

Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.

Unauthenticated file upload in the To Do List Member WordPress plugin (versions 1.4 through 1.6) lets any remote attacker stage attacker-controlled files - including active content such as PHP payloads served from the site's own origin - and also enumerate and delete files already staged there. The plugin ships a standalone upload endpoint that never bootstraps WordPress, so no authentication, capability, or nonce check is ever performed, and only the uploaded filename is validated rather than the file's contents. Publicly available exploit code exists (reported by WPScan), and our assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact - no victim interaction is required, contrary to the vendor vector's UI:R - with the practical limit on real-world risk being the plugin's niche deployment footprint plus any WAF or perimeter rule that blocks direct requests to the endpoint or PHP execution in the upload directory.

Unauthenticated attackers can log in as any user, including administrators, in the WordPress plugin Login with QR through version 1.0.0 because it fails to verify that the QR login code was issued by the plugin, instead matching any stored user metadata value. This critical authentication bypass (CVSS 9.8) requires no authentication or user interaction and is remotely exploitable against default configurations, with publicly available exploit code but no confirmation of active exploitation in the wild. The plugin must be installed and active for exploitation, but its niche deployment footprint is the only limiting factor.

Pressengine WordPress plugin through version 1.0 contains an authentication bypass (CWE-287) that allows unauthenticated attackers to log in as any user, including administrators, because the login handler issues a session even when authentication fails. This critical vulnerability (CVSS 9.8) affects any WordPress site with the plugin installed and active, requiring no special conditions; publicly available exploit code exists. The primary limiting factor is the plugin's low deployment footprint, but where present, it is a top-priority risk.

Unauthenticated attackers can log in as any WordPress user, including administrators, on sites running the Private Feed Key plugin at version 0.1 or below, because the plugin's feed-authentication check accepts any value already stored in a user's metadata instead of verifying a key that the plugin itself issued. The issue is network-reachable with no authentication or user interaction required (CVSS 3.1 9.8, CWE-287, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists; no CISA KEV listing is indicated in the available intelligence supplied for this analysis. Exposure hinges solely on whether this obscure plugin is installed and active - no non-default configuration, special platform, or privileged position is needed - which is why the independent assessment rates it a genuine top-priority vulnerability rather than a high-score-but-low-risk case.

Authentication bypass in WWBN AVideo through 29.0 allows remote, unauthenticated attackers to log in as any user by submitting the victim's stored password hash directly to the login endpoints, completely circumventing password verification. The flaw exists in two independent code paths (loginFromRequest() and encryptPasswordVerify()) and requires prior possession of the users.password hash value-obtained through a separate compromise such as SQL injection, a leaked database backup, or insider access-making it a post-compromise pass-the-hash primitive rather than an initial-access vulnerability. No public exploit code has been identified at time of analysis, but the CVSS 4.0 base score is 9.2; however, the real-world risk is materially lower due to the hash-exfiltration prerequisite.

Unauthenticated information disclosure in AVideo through 29.0 lets any anonymous caller pull owner PII - email address, phone number, physical address, birth date, and administrator status - alongside metadata for videos that are supposed to be visible only to specific user groups. The defect lives in the clean_title branch of the get_api_video API endpoint, which performs no group-membership check when a video is requested by its public slug, so an attacker who knows or enumerates a slug bypasses the access control entirely (CWE-639, tagged Authentication Bypass). No authentication, user interaction, or special client configuration is required (CVSS 4.0 vector shows PR:N/UI:N and VC:H with no integrity or availability impact; the independent assessment agrees with a confidentiality-only 3.1 score), and no public exploit code or CISA KEV entry was identified at time of analysis, leaving the practical risk concentrated in instances that actually host group-restricted videos whose owners have populated profile fields.

Any attacker within Bluetooth Low Energy range can connect to a TCH QRing model R20_B006 smart ring running firmware RT09R20_1.00.00_250318 without pairing, authentication, or user approval, because the device exposes the Nordic UART Service with no client authentication or command authorization. From roughly 10 meters of a worn, powered ring, the attacker bypasses the official companion app and its cloud authentication to read battery status, activate live heart-rate monitoring, and pull stored historical heart-rate and blood-oxygen records. The impact is confidentiality-only (adjacent-vector, unauthenticated per PR:N) with no described ability to modify device state or cause denial of service; no public exploit identified at time of analysis and no vendor-released patch identified.

Broken object-level access control in djust before 1.0.7 lets an authenticated user view - and on some paths act on - object-scoped views they are not authorized for, by loading the page via a direct HTTP GET, navigating to it through SPA url_change, or embedding it as a {% live_render %} child (eager or lazy). The flaw exists because per-object authorization (get_object plus has_object_permission, ADR-017) was enforced only on the WebSocket mount and event paths, leaving these three render entry points unchecked; views that do not define a custom get_object are unaffected. Exploitation requires a valid account (CVSS PR:L), knowledge or enumeration of the target object identifier, and a djust deployment older than 1.0.7 that exposes an object-scoped view through any of those paths, giving high confidentiality impact with limited integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, score 7.1); no public exploit code was identified at time of analysis and CISA KEV does not list this issue.

An authentication/authorization bypass in the djust Python live-view framework (versions prior to 1.0.7) lets unauthenticated remote attackers mount any view over the WebSocket/SSE transport even when that view is protected by standard Django guards such as LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), a custom dispatch() override, or the djust admin extension's staff gate. Because djust authorizes WebSocket mounts through its own check_view_auth helper instead of Django's View.dispatch() chain, those HTTP-only guards are enforced on the initial GET but silently skipped where all events and application state actually flow, so an anonymous or under-privileged client can invoke handlers - including admin list, create, change, and delete operations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) confirms the attack is remote and requires no authentication or user interaction, making this a high-priority flaw; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation is limited to deployments that gate live views with HTTP-only Django authorization patterns - applications using djust's own transport-agnostic login_required, permission_required, or check_permissions attributes are unaffected.

Unauthenticated attackers can fully compromise UVdesk Community Skeleton instances up to version 1.1.8 by submitting crafted requests to unprotected installation wizard endpoints in the ConfigureHelpdesk controller, allowing them to repoint the database and create super administrator accounts. The vulnerability (CWE-306) is present by default and exploitable even on fully installed instances, as the wizard does not check authentication or validate installation state. No public exploit code has been identified at time of analysis, but the critical CVSS 4.0 score of 9.3 and the independent assessment confirm this is a genuine high-priority issue requiring immediate mitigation.

Incorrect authorization in cc-connect through 1.5.0 allows an authenticated, low-privileged user who can trigger Feishu interactive card actions inside an admitted chat to dispatch agent commands, because the onCardAction handler never applies the per-user allowlist that the text message handler enforces. The result is an authorization bypass (CWE-863) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N, with high confidentiality, integrity and availability impact confined to the cc-connect scope), meaning a participant who should not be permitted to drive the agent can still do so remotely without user interaction. Exploitation is access-gated rather than open to the internet at large: the attacker must already belong to a Feishu chat that the deployment has admitted, and no public exploit code or confirmed active exploitation was identified at time of analysis, but the enabled agent-command path makes the impact substantive rather than theoretical.

Multi-statement SQL authorization bypass in Manticore Search 27.0.0 through 28.4.3 lets an authenticated read-only user escalate to full administrative control: the server validates permissions only for the first statement in a batch, so appending additional SELECT statements exposes system credential tables and their password hashes, which can be replayed to authenticate as an administrator without cracking any plaintext. No user interaction is required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the only prerequisite is an existing low-privileged account with SQL access over the MySQL-protocol interface. This is a genuine, actionable priority rather than a high-CVSS-but-low-real-risk paper finding.

Unauthenticated information disclosure in OpenSign through 2.41.3 lets anyone who holds a document identifier taken from a guest signing link retrieve complete document details from the getDocument cloud function, including every signer's information, the sender's identity, and valid download tokens. The exposure only occurs when one-time-password verification is turned off on the server, and the attacker must already possess or guess a valid guest-link document ID; no account, credentials, or user interaction are required in that configuration. Impact is confidentiality-only (no integrity or availability effect) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected versions and configuration are widely deployable.

Authorization bypass in GoAdmin through 1.2.26 allows any authenticated user with a valid session (CVSS PR:L - an account on the target instance is required) to reach administrative endpoints by appending a crafted query string containing the configured admin prefix followed by /logout to a request URL; the permission-checking middleware mistakes the request for the exempt logout route and skips authorization entirely. Successful exploitation permits unauthorized reads of sensitive data and modification of application state (C:H/I:H), with no user interaction needed in a default deployment. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis - the issue is tracked as EUVD-2026-81056 and reported by VulnCheck, and no vendor-released patch version is identified in the available data.

Authentication bypass in OpenNHP through 1.0.2 allows remote unauthenticated attackers to defeat trusted-execution attestation verification by supplying evidence that includes a test_purpose key, which forces the FallbackVerifier to execute unconditionally. Attackers must also provide enrolled measure and serial-number pairs that already exist in the allowlist, which is the primary real-world limiter on exploitability. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact, though the raw CVSS 4.0 score of 8.7 slightly overstates unconditional trivial exploitability.

Remote unauthenticated attackers can bypass all role-based access control on Feast feature servers (feast-dev/feast) through version 0.66.0 by presenting a forged JWT that the OIDC token parser accepts without verifying its signature, granting the attacker a trusted internal identity and unchecked read and write access to entities, feature views, data sources, and permission policies. Exploitation requires the server to be deployed with OIDC authentication and RBAC authorization enabled; an instance running with no authentication has nothing to bypass, and a properly verifying token path is the intended state. No public exploit code has been identified at time of analysis, but the issue is high priority because a network-reachable, unauthenticated attacker can obtain complete loss of confidentiality, integrity, and availability of the server's data.

Missing authorization checks in DiDi KnowStreaming through 3.4.1 allow any authenticated user - regardless of assigned role - to reach protected REST API functionality, including identity-management endpoints that can create administrator accounts or elevate the caller's own privileges. Exploitation requires only a valid low-privilege login (PR:L) with network reach to the REST API; no admin role, user interaction, or non-default configuration is needed, which makes the flaw most dangerous in deployments where accounts are broadly provisioned or self-registration is enabled. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation, but the complete loss of confidentiality, integrity, and availability on affected systems keeps this a genuinely high-priority privilege-escalation issue.

Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one folder to read and modify unrelated pages whose paths share a literal prefix with that folder (for example, access to '/docs' also exposes '/docs-internal'). The flaw lies in the START/END page-rule engine, which matches path prefixes without requiring a path-segment boundary. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) at time of analysis. No vendor-released patch version is identified in the available data, and the assessed CVSS 3.1 base score is 8.1 (High).

Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.

Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.

Unauthenticated file disclosure and disk-exhaustion denial of service in Cisco Secure Firewall Management Center (FMC) let a remote attacker pull sensitive files from a critical management API that performs no authentication checks. The vendor assigns CVSS 7.5, while our independent assessment scores it higher at CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H because the same missing-authentication flaw (CWE-306) yields both confidentiality and availability impact: a single unauthenticated call can exfiltrate restricted files, and sustained repeated invocation exhausts disk until the appliance becomes unresponsive. Affected release trains span FMC 7.3.0 through 7.7.12 plus 10.0.0 and 10.0.1 (tracked as EUVD-2026-81126); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary exposure limiter is network reachability to the FMC management plane.

Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.

Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.

Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.

Improper access control in Cisco Nexus Dashboard, Cisco's data-center orchestration and management appliance, allows a network-positioned attacker who already holds a valid low-privileged account to exceed their intended permissions, with the scope-change (S:C) scoring producing full confidentiality, integrity, and availability impact. Cisco rates the flaw CVSS 9.9 (Critical) under vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; because PR:L is required, this is explicitly an authenticated flaw - a legitimate or stolen operator-level credential is a prerequisite, and it is not unauthenticated. The issue was discovered during Cisco's internal security review and shipped in a hardening release, so no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis; reachability is further limited because Nexus Dashboard is typically deployed on internal management networks rather than exposed to the internet.

Missing authentication for critical functions (CWE-306) in Cisco Nexus Dashboard allows unauthenticated, remote attackers to access protected functionality, resulting in a CVSS 9.8 (Critical) rating with high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and real-world exploitation requires network reachability to the management interface, which is typically restricted to isolated management networks. The vulnerability is part of a Cisco hardening release addressing multiple internally discovered issues; exact affected versions and functions are not specified in available data.

Authorization bypass in Zalando Skipper before 0.27.37 lets unauthenticated remote attackers slip an oversized request body past an Open Policy Agent body-inspection policy: when the opaAuthorizeRequestWithBody filter truncates the body at maxBodyBytes, Skipper derives the input.truncated_body signal from Content-Length rather than the bytes actually read, so an HTTP/1.1 chunked or Content-Length-less HTTP/2 request is evaluated by OPA as non-truncated, allowed, and then forwarded in full to the protected upstream (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, CWE-863). Exploitation is gated on a non-default deployment: the filter must be active and the policy must explicitly allow requests when input.truncated_body == false, the pattern recommended as the prior mitigation for CVE-2026-50197, while installations that do not inspect bodies or do not key on truncated_body are unaffected and requests carrying an accurate Content-Length are correctly flagged as truncated and denied. No public exploit identified at time of analysis.

Unauthenticated remote attackers can read trace and funnel analytics from SigNoz deployments running versions 0.88.0 through 0.141.0 because the trace-funnel analytics HTTP handlers were registered without any authorization wrapper. A single unauthenticated POST to endpoints under the trace-funnels router (both the /{funnel_id}/analytics/* and /analytics/* payload variants) returns identifiers, durations, span counts, service topology, and error activity, and because the payload-style handlers accept attacker-supplied funnel definitions, no pre-existing funnel or account is required. Exploitation is bounded by network reachability to the query-service listener and is read-only (no modification or code execution), and no public exploit code has been identified at time of analysis.

SIMAC MyPHR 1.1 exposes an insecure direct object reference (IDOR) in its employee-update API that lets any authenticated user with a valid low-privileged account access and modify arbitrary employee records. By sending a PUT request with another employee's identifier and a controlled password value, an attacker can take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information such as private pay bulletins. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 base score of 8.7; active exploitation has not been confirmed by CISA KEV status in the provided data.

Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No public exploit code was identified at time of analysis.

Local attackers with write access to Nuclei's on-disk template storage can bypass template signature verification and cause arbitrary operating system commands to execute from a tampered template in ProjectDiscovery Nuclei versions before 3.11.1 (reported as 3.7.0 through 3.10.x). The root cause is CWE-347: cached signature-verification results were keyed only on a template file's modification time, so an attacker can swap a previously verified template for unsigned malicious content and restore the original mtime to have the stale 'verified' result reused under the default configuration where unsigned templates are disabled. The assessed attack path requires local low-privilege access (CVSS 4.0 PR:L) plus a victim operator actually running a scan against the tampered template (UI:P), so this is an access-gated supply-chain integrity flaw rather than a remotely exploitable or wormable one; no public exploit identified at time of analysis, and the vendor-released fix in 3.11.1 binds cache reuse to a content digest.

Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.

Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.

Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.

Signature forgery in Sequoia OpenPGP (sequoia-openpgp) stems from incorrect key-flag inference for legacy OpenPGP certificates that lack a key-flags subpacket, letting an unauthenticated remote attacker bypass the back-signature check and bind an arbitrary subkey to their own certificate. This compromises cryptographic integrity for any application that uses the library to verify untrusted certificates, although exploitation requires the victim to process a crafted certificate (UI:R). No public exploit code or CISA KEV entry was identified in the provided data.

Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. Impact is integrity-only (CVSS 3.1 assessed: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; vendor-published CVSS 4.0 score 7.1, VI:H), requiring only a valid low-privileged account with no admin role and no user interaction; no public exploit code was identified at time of analysis.

Improper access control in stylefeng Guns through 8.3.5 lets any authenticated user, even one with no assigned roles, create, edit, delete, publish, and retract system-wide notices via SysNoticeController actions that never require a permission. The issue is remotely exploitable with low privileges and high integrity impact but no confidentiality or availability impact; no public exploit code has been identified at time of analysis, and authentication is required (PR:L) because the attacker must already have a valid Guns session.

Missing authorization in the Guns Java rapid-development framework (through 8.3.5) allows any authenticated user to harvest the full user directory, including account names, real names, email addresses, phone numbers, last-login IPs and role assignments. The /sysUser/detail and /sysUser/page handlers in SysUserController omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them and returns data for every user in the system to anyone holding a valid login token. The attack is network-reachable and needs only a low-privileged authenticated session (PR:L), with no user interaction and no administrative rights; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied in the source data.

Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.

Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.

Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR methods by sending a POST to a URL their role is allowed to reach while naming a privileged class and method in the request body, bypassing Spring Security's URL-pattern-only access control; the assessed severity is CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact once the flaw is chained with the other Tenable-reported findings it enables. Exploitation is not anonymous: the attacker must already hold a valid low-privilege ScadaLTS session, and the deployment must run with DWR's crossDomainSessionSecurity setting set to false in web.xml (the default in the affected build), which disables DWR's built-in origin and session validation. No confirmed active exploitation (CISA KEV) and no public exploit code were identified in the available intelligence at time of analysis, so the practical urgency is driven by the credential precondition rather than by observed attacks.

reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. No public exploit identified at time of analysis, and successful exploitation requires an authenticated account plus configured integrations to expose meaningful secrets.

This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.

IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.

Authorization bypass in @fastify/auth versions 5.0.0 through 5.1.0 lets an authenticated low-privileged attacker who possesses a credential satisfying only the final member of a nested AND group, such as a valid API key without administrator rights, be authorized instead of rejected. The flaw occurs when strategies are composed with the relation "or" option together with the run "all" option and an entry is a nested array acting as an AND group, causing the group result to collapse to its last check; a mirror order-dependent bypass exists for top-level relation "and" with a nested "or" group. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the vendor-released fix is version 5.1.1 or later.

Sandbox escape in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated Jenkins user who is permitted to define and run sandboxed scripts - including Pipeline jobs - to break out of the Groovy sandbox and execute arbitrary code on the Jenkins controller. The flaw is a protection-mechanism failure (CWE-693): the sandbox's call-site interception does not cover methods that are added dynamically to a class at runtime, so a crafted script can invoke such a method and run code that should have been blocked. Exploitation requires script-authoring privileges (PR:L) and a deliberately crafted script (AC:H) with no user interaction, giving high confidentiality, integrity, and availability impact on the controller; no public exploit code was identified at the time of analysis, and the practical risk is concentrated in multi-tenant Jenkins deployments where lower-trust users are delegated Pipeline authoring.

Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.

Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.

Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.

Missing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one with zero assigned roles - invoke administrative APIs for user management, role assignment, password resets by user ID, and Elasticsearch index deletion, because the shipped default of zlt.security.auth.urlPermission.enable is false and suppresses all permission checks once authentication succeeds. Exploitation is not pre-auth: it requires a valid low-privilege session against a deployment running the out-of-the-box configuration, and publicly available exploit code exists (VulnCheck-reported PoC scripts covering role-granting, user enumeration, password reset, and ES index deletion), though no confirmed active exploitation (CISA KEV) has been recorded. Assessed severity is high (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8; vendor-published CVSS 4.0 score 8.7) because a zero-role user obtains both read and write access to sensitive administrative functions.

Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.

Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.

WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.

Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. Impact is total: full read/write/execute control of the administrative panel, which is why the score is high (CVSS 4.0 8.7; assessed CVSS 3.1 8.7, C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor firmware 1.1.0.651412 resolves the issue.

Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.

Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.

Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege operators - to read the installation-wide audit trail by calling GET /admin-api/crm/operatelog/page, exposing operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. Publicly available exploit code exists (a PoC script that queries the endpoint), and although exploitation requires a valid back-office session with network reach to the admin API, no elevated role or user interaction is needed, so the realistic threat is a malicious insider or anyone who has reused or stolen an operator credential. The vulnerability is broken access control (CWE-862) with high confidentiality impact only; it does not permit data modification, service disruption, or pre-authentication compromise.

Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales leads belonging to other employees by invoking the CrmCluesController receiveCustomer lead-claim endpoint with a manipulated ownerUserId value. The flaw is a broken access control (CWE-862) issue that requires only a valid low-privilege staff login and no administrative role, feature toggle, or user interaction, with the practical impact limited to integrity of lead ownership data (no confidentiality or availability impact). Publicly available exploit code exists in the form of a Python proof-of-concept targeting the endpoint, and the absence of access logging or quota validation on the operation removes any built-in brake on bulk lead theft, though no confirmed active exploitation (CISA KEV) has been observed at time of analysis.

Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).

Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privilege level, invoke the saveRedisSet and getRedisSet endpoints in CrmCustomerController and rewrite the installation-wide Redis keys that drive lead allocation and customer auto-recycling. Because the scheduled CustomerAutoJob consumes those same keys, a low-privilege staff account can disable recycling, block customer creation, or trigger mass customer deletion across the deployment; publicly available exploit code exists (the VulnCheck-referenced CVE request PoC on GitHub), while no active exploitation has been confirmed and the CVE is not listed in CISA KEV. This is a genuine but bounded-priority issue: exploitation requires a valid CRM account (assessed CVSS PR:L, so unauthenticated remote abuse is not possible), and the assessed impact is high integrity loss to shared policy state (I:H) with a limited availability effect (A:L) and no confidentiality loss (C:N - the readable values are configuration/policy keys, not customer records).

Wild-pointer dereference in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets an unexpected STATUS_TYPE completion IOCB reach a SCSI-only fast path, where the srb union is reinterpreted so sp->u.scmd.cmd reads as a non-NULL garbage pointer and is dereferenced. Only hosts running the qla2xxx driver with a physical QLogic FC HBA are exposed, and only when the adapter firmware or FC fabric delivers a mis-typed status IOCB that coincides with a live non-SCSI outstanding handle; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, so the realistic outcome is a kernel crash rather than reliable code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor patches are available for all maintained stable branches.

Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.

Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.

SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.

Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.

Unauthenticated remote access to the configuration download function on XikeStor Layer3 switches (SKS8300-8T, SKS8300-12E2T2X, SKS8310-8X) running firmware below V1.04.B09 exposes full device configuration files to any network-reachable attacker. Recovered configurations contain network topology details and credentials, enabling attackers to authenticate to the switch itself or leverage it as a pivot point into the protected network segment it manages. Disclosed by JPCERT/CC (JVN#45281119); no public exploit code or active exploitation (CISA KEV) identified at time of analysis.

Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.

Broken access control in the MultiVendorX WordPress plugin (versions 5.0.0 through 5.0.15) allows any authenticated user, including a subscriber with no vendor privileges, to overwrite arbitrary stores' details and payout settings and to reassign a store's ownership record through a REST API route that fails to verify the caller owns the target store. Publicly available exploit code exists and the vendor has released a fixed version (5.0.16), so the primary exposure window is sites that have not yet updated; CISA KEV does not list this issue and the EPSS score is low (0.17%, 7th percentile), indicating speculative rather than mass-exploitation risk. The practical impact is high where open user registration is enabled, because a freshly created subscriber account is sufficient to tamper with merchant payout configuration and store ownership, and exploitation requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.

Unauthenticated attackers can take over arbitrary WordPress accounts - including administrator accounts - on any site running the TrueBooker - Appointment Booking and Scheduler System plugin through version 1.2.3, by invoking a plugin AJAX action that changes a target user's email address without any authorization check (CWE-862); the attacker then triggers WordPress's standard email-based password reset to that address and gains full control of the account. The issue is remotely exploitable with PR:N (no authentication, no user interaction, no non-default configuration required) and carries a CVSS 3.1 base score of 9.8, though EPSS is a low 0.42% (36th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis. Independent assessment rates this as a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the limiting factor is deployment footprint (a niche booking plugin), not any technical prerequisite.

Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.

The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.

Let me synthesize. Product: Arista EOS. Key data: CVSS 4.0 vector: AV:A (adjacent), AC:H, AT:P (attack requirements present), PR:N, UI:N, VC:N, VI:N, VA:H, SC:N, SI:N, SA:H. CVSS score 7.0. CWE-863 (Incorrect Authorization) — hmm, that's a bit odd for a malformed packet handling issue; likely a mismatch worth flagging in confidence notes. Tags: "Authentication Bypass" — that seems mislabeled; the description is about malformed IS-IS LSP PDU causing graceful restart procedure termination — an availability issue, not auth bypass. Also CWE-863 mismatch. I could emit a data_quality_flag mislabeled_tag "Authentication Bypass". Hmm — is that highly confident? The description says unauthenticated attacker, but it's not authentication bypass — it's a protocol-level denial of service. CWE-863 incorrect authorization. The tag "Authentication Bypass" is arguably wrong. I think it's defensible to flag as mislabeled_tag with medium/high confidence. Let me consider: the rule says only emit flag when input metadata clearly wrong and verifiable. The tag "Authentication Bypass" doesn't match a DoS/availability issue in IS-IS graceful restart. But the CWE is 863 = Incorrect Authorization, which aligns with the tag... though CWE-863 for IS-IS graceful restart is questionable. Hmm. Given the CWE given is 863, the tag isn't clearly wrong relative to provided metadata. I'll be cautious: maybe emit a medium-confidence flag. Actually the guidance says empty array is common and correct. But there's genuine mismatch: description is a malformed packet causing premature termination of graceful restart = availability. No authentication bypass occurs. I'll emit one flag with medium confidence. Hmm, risk of being penalized. I think it's reasonable and defensible... Let me lean toward emitting it since the description clearly describes DoS via malformed packet with no authorization bypass. Actually, tagging "Authentication Bypass" would cause wrong categorization. I'll emit with medium confiden

SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.

Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.

An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.

Netcore NR268 routers running firmware 1.7.121109 accept forged firmware images because the mtd_write flashing path does not properly validate the firmware authenticity check performed by check_image_uuid.c, allowing an attacker who can reach the upload endpoint (put_file.cgi) with low privileges to load unauthorized firmware. Successful exploitation gives an attacker full control over the device — high confidentiality, integrity and availability impact per the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) — and the malicious image persists across reboots. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public technical write-up of the forgery technique and a VulnCheck advisory are available.

Unauthenticated remote attackers with network reachability to the mySCADA myPRO Manager command API can invoke privileged management functions because the API fails to enforce authorization on those endpoints. All deployments of mySCADA myPRO up to and including version 2.1 are reported as affected, and exploitation requires no credentials and no user interaction (CVSS 4.0 base 9.3; independent assessment agrees on a network-reachable, PR:N/UI:N critical-severity issue with high confidentiality, integrity, and availability impact). No public exploit code has been identified and CISA KEV does not list this CVE, but EPSS places it around the 50th percentile (0.65%), so the practical risk is driven mainly by whether the OT management interface is reachable from attacker-controlled networks.

Google Chrome versions earlier than 153.0.8010.47 contain an incorrect authorization flaw (CWE-863) in the WebUI subsystem that lets an attacker who already controls a compromised renderer process break out of the browser sandbox and run arbitrary code on the host via a crafted HTML page. Exploitation is a two-stage proposition: the attacker must first obtain renderer code execution, then chain this flaw to escape the sandbox, and the victim must load the malicious page. Google rates the Chromium security severity as High and has shipped a fix in Chrome 153.0.8010.47; no public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.

Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.

Missing authorization in Chrome's AppManifest handling (CWE-862) lets an attacker who has already compromised the renderer process bypass web origin policy and load a crafted HTML page inside a trusted origin context, yielding high confidentiality and integrity impact. Exploitation is not a default-config remote attack: it requires two stacked preconditions - a pre-compromised renderer (typically via a separate prior bug) plus social engineering to induce victim interaction with the malicious page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R) the attacker is remote and unauthenticated, but user interaction is mandatory; our independent assessment raises attack complexity to High (AC:H) because the renderer must first be subverted, and Google's own rating is 'Chromium security severity: Medium'. EPSS is low at 0.25% (16th percentile) and no public exploit has been identified at time of analysis; the fix ships in Chrome 153.0.8010.47, so patched and auto-updated browsers are not affected.

Unauthenticated HTTP(S) requests to Digital Watchdog VMAX-series video recorders (VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder, VMAX A1 PLUS, VA1G4 Recorder) can bypass authentication and return sensitive device data, including administrator credentials in plaintext. The flaw is a missing authentication check on a critical function (CWE-306) scored 7.1 with a CVSS 4.0 vector of AV:A/AC:L/PR:N/UI:N/VC:H, meaning adjacent-network attackers with no credentials and no user interaction can fully read the exposed information but cannot modify or disrupt the device. It was reported through CISA ICS-CERT advisory ICSA-26-258-01 and is not listed in CISA KEV, and no public exploit code was identified at time of analysis.

Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.