Authentication Bypass

Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.

Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.

Authentication bypass in Red Hat's search-v2-api exposes federated search results to unauthenticated remote attackers. The authentication middleware unconditionally skips validation when an HTTP request carries the `Upgrade: websocket` header, allowing any network-reachable attacker to POST to the `/federated` endpoint without credentials. Exploitation yields information disclosure across all configured remote managed hubs - no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, but the CVSS 7.5 score and PR:N vector reflect low-barrier, network-accessible exploitation.

Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet.

Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.

Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.

Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.

Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.

Cross-tenant project takeover in Taubyte Tau v1.1.10 enables any authenticated GitHub user to read or permanently delete projects belonging to other tenants by supplying arbitrary project IDs to the GET and DELETE /projects/{id} HTTP endpoints. The GitHubTokenHTTPAuth middleware performs only token validity checks, exposing bare KV-store operations (projects.Fetch and project.Delete) to any caller holding a valid GitHub OAuth token without verifying project ownership. No public exploit exists and SSVC confirms no observed exploitation, but the low-privilege requirement (any GitHub account) combined with permanent data destruction capability makes this a critical multi-tenant isolation failure for any exposed Tau deployment.

ORM injection in NetBox 4.5.8's WritableNestedSerializer allows any authenticated user - including those holding only read-only API tokens - to extract sensitive field values across all application modules via boolean-based blind data leakage. By supplying crafted Django ORM lookup expressions as JSON dictionary keys in REST API write requests, attackers bypass object-level permission controls across dcim, ipam, tenancy, virtualization, circuits, and extras. No CISA KEV listing exists, but VulnCheck reported the issue and an upstream fix commit is available; no confirmed public exploit code has been identified at time of analysis.

Missing authorization in OpenIM Server v3.8.3 allows any authenticated user to invoke admin-only REST API endpoints and enumerate the entire platform's user and group data. The GetPaginationUsers, GetAllUserID, and GetGroups RPC handlers in internal/rpc/user/user.go and internal/rpc/group/group.go lack the required authverify.CheckAdmin() guard, meaning a regular bearer token is sufficient to harvest all user IDs, nicknames, manager-level flags, and full group listings including private groups the caller has never joined. No public exploit has been identified at time of analysis, but the low attack complexity makes opportunistic exploitation trivial for any credentialed platform user.

Federation-based metadata takeover in PeerTube before 8.2.2 lets a malicious remote ActivityPub server rewrite videos it does not own on a victim instance. Because processUpdateActivity/processUpdateVideo never verify that the signing actor's host matches the host in the target video's id (videoObject.id), any federated peer can push an Update that overwrites another server's video title, description, visibility, stored media file, and HLS playlist URLs. No public exploit or CISA KEV listing is identified at time of analysis, but the flaw is remotely reachable without authentication on the victim and carries a 9.3 CVSS with a scope change.

Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorization flaw that lets a remote attacker bypass authentication and run code in the context of the current user. Adobe's PSIRT rates it CVSS 10.0 with a changed scope, meaning a successful attack can impact resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical but the severity is maximal.

Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.

Authentication bypass in MaxKey identity/SSO server (versions 0 through 4.1.11) lets unauthenticated attackers mint valid JWTs using a hard-coded, publicly known signing secret shipped in application-maxkey.properties and present them to the /sign/login/jwt/trust endpoint to obtain a fully authenticated admin session. Because affected builds ship with JWT login enabled by default (LOGIN_JWT defaulting to true), an attacker can set an arbitrary subject claim to impersonate any user, including administrators, gaining control of SSO application configuration and downstream application secrets. No public exploit identified at time of analysis and no CISA KEV listing, but the trivial exploitation path and VulnCheck advisory make this high priority.

Cross-workspace session hijacking in Typebot 3.16.1 allows an authenticated low-privileged user to inject arbitrary webhook payloads into another workspace's active WhatsApp preview session by supplying a valid typebotId they control alongside a victim's preview phone number. The WhatsApp test-webhook handler authorizes the caller against their own typebot but then resolves the target session exclusively by the phone-keyed session ID (`wa-preview-{phone}`), making no ownership binding between the resolved session and the requesting typebotId. As a result, an attacker can advance or corrupt another workspace's unpublished chatbot flow without any authorization on that typebot. No public exploit has been identified; patch is confirmed available in version 3.17.0.

Arbitrary code execution in Adobe Lightroom Classic versions up to 15.4.1 is achievable when a victim opens a specially crafted malicious file, exploiting an Incorrect Authorization flaw (CWE-863) that allows attacker-controlled code to execute in the context of the current user. The attack scope extends beyond the application boundary (S:C), amplifying impact to potentially affect the underlying OS or co-running user-context processes. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based delivery model and creative professional user base make this a targeted phishing risk.

Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows remote unauthenticated attackers to bypass security controls and gain unauthorized read access to protected resources. Affected are all major supported branches of Adobe Commerce (2.4.4 through 2.4.9-2026-jul), Adobe Commerce B2B (1.3.3 through 1.5.3-2026-jul), and Magento Open Source (2.4.6 through 2.4.9-2026-jul). No public exploit has been identified at time of analysis, though the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially exploitable at scale once a technique is known.

Incorrect Authorization in Adobe Commerce and Magento Open Source allows a low-privileged authenticated attacker to bypass security controls over the network without user interaction, gaining unauthorized read access and high-integrity write access across affected store resources. The vulnerability covers a wide span of actively supported release lines - Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3 - making the exposure broad for merchants who have not applied August 2026 security patches. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity impact (I:H) is particularly concerning for e-commerce environments where unauthorized write access could affect orders, pricing, or customer records.

Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated attacker run code in the context of the current user via an incorrect-authorization flaw (CWE-863). The maximum CVSS 3.1 base score of 10.0 reflects a network-reachable, no-interaction bug with a changed scope, meaning impact can extend beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE and a vendor PSIRT advisory makes this a top-priority patch.

Privilege escalation in Microsoft Azure CycleCloud (versions prior to 8.9.1) allows an authenticated low-privilege network attacker to elevate to higher privilege levels due to missing authorization checks (CWE-862). The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with no user interaction required, though exploitation demands valid credentials. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, though SSVC rates the technical impact as total.

Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attacker who can induce user interaction. The root cause is CWE-636: when the application encounters an error or edge condition in a security enforcement path, it defaults to granting rather than denying access, neutralizing the intended control. With a CVSS score of 8.2 and a scope-changed vector (S:C) paired with high confidentiality impact, successful exploitation could expose data or capabilities beyond the direct VS Code process boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local security feature bypass in Visual Studio Code allows an attacker with local access to circumvent an authorization control, achieving high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability (CWE-693, Protection Mechanism Failure) is exploitable locally without elevated privileges but requires user interaction, making social engineering or physical access the likely delivery path. No public exploit code or active exploitation has been identified at time of analysis.

Type confusion (CWE-843) in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack is file-based: no attacker privileges are required, but the target user must open a malicious document, making this a high-impact phishing-delivery vector. No public exploit code and no CISA KEV listing are identified at time of analysis, but the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a critical priority for organizations where Excel is deployed.

Untrusted pointer dereference in Microsoft Office Excel enables local arbitrary code execution when a user opens a crafted document. The flaw (CWE-822) allows an attacker who can deliver a malicious file to achieve full code execution with high confidentiality, integrity, and availability impact on the victim's system. No public exploit has been identified at time of analysis, and Microsoft has not listed this in CISA's Known Exploited Vulnerabilities catalog.

Type confusion (CWE-843) in Microsoft Office Excel enables local code execution by an unauthenticated attacker when a victim opens a specially crafted Excel document. The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a file-borne attack requiring user interaction but no attacker privileges, with full High/High/High C/I/A impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the memory corruption tag suggests the type confusion leads to exploitable heap or stack corruption.

Local privilege escalation in the Windows Cross Device Service (CVE-2026-66804) allows a low-privileged authenticated user to gain SYSTEM or elevated permissions on the local machine. The flaw stems from CWE-284 (Improper Access Control), meaning the service fails to adequately enforce authorization boundaries between user privilege levels. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a straightforward target for post-compromise lateral movement or privilege escalation tooling.

Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.

Type confusion in Microsoft Office Excel's file-processing engine enables remote code execution when a user opens a specially crafted spreadsheet document. The vulnerability carries a CVSS 8.8 High score with full confidentiality, integrity, and availability impact against the Excel process, requiring only user interaction to trigger - the classic phishing-attachment threat model. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.

Privilege escalation in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows a low-privileged authenticated attacker to gain elevated access over the network by invoking a critical internal function that lacks proper authentication enforcement. The flaw (CWE-306) is exploitable with low complexity and no user interaction, resulting in full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity against a widely-deployed enterprise platform makes this a priority patching target.

Local code execution via untrusted pointer dereference in Microsoft Office affects multiple product lines - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and Mac editions - when a victim opens a specially crafted document. The root cause (CWE-822) enables memory corruption through unvalidated pointer values sourced from attacker-controlled file content, yielding full confidentiality, integrity, and availability compromise of the targeted user session. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available through Microsoft Update channels.

Type confusion (CWE-843) in Microsoft Office enables local code execution across multiple Office product lines when a user opens a crafted file. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. With high confidentiality, integrity, and availability impact and user-interaction-only as the sole prerequisite, the vulnerability presents meaningful risk in phishing and malicious-document delivery scenarios. No public exploit identified at time of analysis, though a vendor patch is available.

Code execution in Microsoft Word stems from a numeric truncation error (CWE-197) in the document processing engine, affecting Word 2016, Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires a user to open a specially crafted document, after which an attacker can execute arbitrary code with full confidentiality, integrity, and availability impact under the victim's session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, Microsoft has confirmed and released a patch, indicating completed vendor triage.

Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target.

Privilege escalation via capture-replay authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition exposes organizations to full mailbox and administrative compromise. An already-authorized low-privilege network user can intercept and replay authentication tokens to impersonate higher-privileged accounts, achieving high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing exists at time of analysis, but Microsoft has released patches across all affected cumulative update tracks.

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.

Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.

Privilege escalation in Microsoft .NET Framework via incorrect authorization (CWE-863) allows network-authenticated low-privilege attackers to elevate their privileges, achieving full compromise of confidentiality, integrity, and availability on affected systems. Affected release families span .NET Framework 3.5 through 4.8.1, covering a broad swath of Windows enterprise deployments across multiple independently-installed runtime versions. No public exploit has been identified at time of analysis; a vendor-released patch with specific fix version thresholds is available through the Microsoft Security Response Center.

Privilege escalation in Microsoft SharePoint allows an authenticated low-privilege attacker to elevate to higher permissions over a network, exploiting improper authentication logic (CWE-287). Three on-premises SharePoint versions are confirmed affected - Enterprise Server 2016, Server 2019, and the current Subscription Edition - with vendor-released patches available for all. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score and full High C/I/A impact profile make this a serious priority for organizations running unpatched on-premises SharePoint.

Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.

Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.

Privilege escalation in Windows License Manager exposes a critical authenticated-but-low-privileged local attacker path to full SYSTEM-level control across a wide range of Windows client and server builds. The root cause (CWE-306) is a missing authentication gate on a privileged License Manager function - an authorized standard user can invoke it without satisfying the elevated-privilege check that should protect it. Microsoft has released patches covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Windows Installer (msiexec) affects virtually the entire modern Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - via an incorrect authorization flaw (CWE-863). An attacker with low-privilege authenticated local access can exploit the broken authorization check within the Installer service to elevate to SYSTEM-level privileges, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis, though Microsoft has released patches across the full affected version matrix per MSRC advisory.

Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows Server and client platforms, allowing a locally authenticated low-privilege user to elevate to SYSTEM-level access by invoking a critical RDS function that lacks proper authentication enforcement (CWE-306). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected versions.

Privilege escalation in Windows Remote Desktop Services (RDS) via a missing authentication check (CWE-306) allows a locally authenticated, low-privileged user to gain SYSTEM or administrator-level access on the target machine. The vulnerability affects an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - multiplying the organizational exposure. No active exploitation is confirmed by CISA KEV and no public exploit code is identified at time of analysis, though the low attack complexity (AC:L) and absence of required user interaction make the technique straightforward once a local foothold is achieved.

Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, allowing a locally authenticated low-privilege attacker to elevate to full SYSTEM-level control. The root cause is CWE-306 - a critical RDS function entirely lacking an authentication gate - meaning any low-privilege account holder can invoke it without proper authorization. Microsoft has released patches across all affected product lines, though no public exploit code or CISA KEV listing was present in the available intelligence.

Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.

Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.

Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check (CWE-862) on a network-accessible code path, allowing an unauthenticated network attacker to execute arbitrary code on a victim's machine with high impact across confidentiality, integrity, and availability. Exploitation requires user interaction (CVSS UI:R), meaning the victim must engage with attacker-controlled content. A vendor-released patch is available in version 1.132.1; no public exploit code or CISA KEV listing is confirmed at time of analysis.

Security feature bypass in Visual Studio Code (versions 1.0.0 through 1.132.1) exploits CWE-639, where authorization decisions rely on attacker-controllable keys, allowing a local attacker to circumvent an intended access control with high impact across confidentiality, integrity, and availability. The attack requires no elevated attacker privileges but does require a legitimate VS Code user to interact with the manipulated environment, pointing to shared-workstation or social-engineering delivery paths. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis; a vendor-released patch is available at version 1.132.1.

Spoofing via origin validation failure in Windows Network Address Translation (NAT) exposes Windows Server 2025 and Windows 11 (versions 24H2 through 26H1) to network-layer address spoofing by unauthenticated attackers on an adjacent network. The flaw, rooted in CWE-346, allows crafted packets to bypass NAT's origin-trust enforcement, potentially enabling man-in-the-middle interception or manipulation of traffic transiting the NAT boundary. The CVSS scope change (S:C) reflects that the impact extends beyond the host running NAT to other systems whose traffic passes through it. No public exploit code or active exploitation has been confirmed at time of analysis.

Security feature bypass in the Python extension for Visual Studio Code (versions prior to 1.132.1) allows a local attacker to load functionality from an untrusted control sphere, achieving full compromise of confidentiality, integrity, and availability. The attack requires user interaction - specifically opening a malicious workspace or project directory - making it highly relevant in developer supply-chain and social engineering scenarios such as cloning a weaponized repository. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the full CIA impact and low attack complexity elevate real-world concern for development environments.

Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.

Local privilege escalation in the Windows RPC API exploits a missing authentication gate on a critical function (CWE-306), enabling any low-privileged authenticated local user to attain SYSTEM-level control across a sweeping range of Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard user account with no user interaction. No public exploit code is identified at time of analysis, and CISA SSVC rates current exploitation status as none, though technical impact is rated total.

Authentication bypass in Zoho ManageEngine DDI Central versions prior to 6201 lets remote unauthenticated attackers hijack the password-reset workflow to seize control of arbitrary accounts. Successful takeover of an administrative account grants full control over the DNS, DHCP, and IPAM management platform, with total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not on CISA KEV, though CISA's SSVC framework rates the flaw as fully automatable with total technical impact.

Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.

Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security controls and gain limited unauthorized read and write access to protected resources, with a limited disruption to availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and is reachable over the network under low complexity conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.

Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.

Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.

Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.

Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.

Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.

Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.

Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user holding read access to at least one typebot to inject arbitrary JSON payloads into a suspended webhook session owned by a completely different typebot on the same instance. The handler validates authorization against the caller-supplied typebotId but then resolves the session result record solely by resultId without binding it to the authorized typebot, enabling an attacker to mix a legitimately authorized typebotId and blockId with a foreign live resultId to hijack cross-tenant execution flow and advance the victim's business logic. No public exploit has been identified at time of analysis; vendor-released patch version 3.17.0 is available and resolves the flaw.

Cross-workspace credential injection in Typebot's Google Sheets OAuth callback allows an authenticated attacker to plant Google Sheets credentials into workspaces they do not own, and - if target IDs are known - attach those credentials to blocks inside victim Typebots. The root cause is that the OAuth callback decodes and blindly trusts a client-supplied, unprotected base64 JSON state parameter without verifying the authenticated user holds write access to the referenced workspaceId or typebotId. All Typebot versions prior to 3.17.0 are affected; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.

Unauthorized cross-workspace Google Sheets credential exposure in Typebot prior to version 3.17.0 allows any authenticated user to call the `POST /api/sheets/getSheets` endpoint with an arbitrary workspace ID, bypassing membership checks entirely. The handler decrypts and returns the target workspace's stored Google Sheets OAuth tokens along with spreadsheet metadata (sheet names, IDs, and column headers), constituting a direct credential theft vector against any workspace with a Google Sheets integration configured. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low exploitation complexity makes this a credible insider or multi-tenant threat.

Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Provider for authentication. Velociraptor maps OIDC email claims directly to internal usernames without validating the IdP's email_verified flag, enabling an attacker with any account on the same IdP to change their registered email address to match a target user's and seamlessly inherit that user's Velociraptor session and privileges. Given Velociraptor's role as a DFIR and endpoint monitoring platform, successful exploitation could expose sensitive forensic data, endpoint telemetry, and incident response artifacts. No public exploit code has been identified at time of analysis.

Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigger execution of secret-protected generic webhook graphs as their registered owner. The flaw stems from the ingress router selecting the webhook manager from the untrusted URL provider path segment rather than from the stored webhook record, meaning a request routed through the /compass/ path invokes CompassWebhookManager's inherited no-op verify_signature instead of GenericWebhooksManager.verify_signature, neutralizing the X-Webhook-Secret guard entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the fix is available in the confirmed release v0.6.70.

Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and write data belonging to sibling tenants whose path names share a string prefix. Versions prior to 4.24 are affected: a scoped JWT issued for /tenant1 inadvertently passes the authorization check for /tenant1234, /tenant1-old, and any other path that begins with the same character sequence, because the check used Go's raw strings.HasPrefix rather than a path-component boundary comparison. No public exploit code has been identified at time of analysis, but the bypass is mechanically trivial for any holder of a valid scoped token and the exact attack patterns are documented in the fix's test suite.

Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without any credential check whenever jwt.filer_signing.key is left unset, which is the default. Any client able to reach the filer's gRPC port can invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint their own access keys and obtain S3 administrative control over the storage cluster. Rated CVSS 9.8; no public exploit identified at time of analysis, though the upstream fix commit and PR are public.

Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless of company affiliation - to read full ticket content (titles, descriptions, attachments), hijack tickets by overwriting their company_id, and delete tickets belonging to any other tenant on the shared instance. The root cause is a missing authorization boundary in three distinct Eloquent query paths that retrieve tickets by numeric ID without scoping results to the authenticated user's company, compounded by the delete controller accepting a generic HTTP request class that bypassed the application's own permission gate entirely. No public exploit code or CISA KEV listing exists at time of analysis; however, the Secur0 advisory documents the attack surface with sufficient detail for reproduction, and the CVSS 4.0 score of 8.6 reflects the genuine severity of multi-tenant isolation failure.

Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-privileged GUI user to impersonate any other user, including admins, by supplying a crafted 'Grpc-Metadata-USER' header, resulting in full account takeover. The flaw stems from the gRPC/GUI layer trusting a client-supplied identity header instead of the authenticated session. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the fix is trivial to reverse-engineer once the header name is known.

Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.

Broken access control in Craft CMS 5.0.0-RC1 through 5.10.5 lets a control-panel user holding only the viewCategories permission permanently reorder and re-parent categories through the structures/move-element action, despite lacking saveCategories. Because category URIs are derived from structure position, an attacker can silently change category URLs and those of all descendants and corrupt taxonomy-driven navigation menus. Reported by VulnCheck with no public exploit identified at time of analysis; the flaw is an integrity-only bypass fixed in 5.10.6.

Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.

Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.

Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.

Server-side authentication bypass in FreeRDP 3.x (confirmed through 3.27.1) allows an unauthenticated remote attacker to obtain a fully authenticated RDP session without supplying any credentials, GUID, or reconnect cookie when the server has RdstlsSecurity enabled. The flaw combines PDU-type confusion - the server routes inbound messages based solely on the client-supplied wire pduType without enforcing handshake state - with a calloc-zeroed result code that maps directly to RDSTLS_RESULT_SUCCESS, so sending a Capabilities PDU in place of the required Authentication Request PDU produces an unconditional authentication success response. No public exploit code or CISA KEV listing has been identified at time of analysis; the upstream fix commit is confirmed but a released patched version was not independently verified at advisory time.

Unauthenticated account creation in Swing Music 3.0.0 exposes a critical access control gap: the POST /auth/profile/create endpoint is explicitly allowlisted from JWT verification, enabling any network-reachable attacker to register arbitrary user accounts with no credentials. Once registered, the attacker-controlled account can be used to authenticate and access server-protected functionality such as media libraries or administrative features. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity network vector makes opportunistic exploitation straightforward against exposed instances.

Unauthenticated remote access to all contact form submissions, including personally identifiable information, is possible in CSZ CMS 1.3.2 due to a broken access control flaw in the admin form-submission viewer. The endpoint omits an authentication check entirely, and the underlying framework authentication helper fails open rather than denying access by default - meaning the bypass is a structural failure, not a simple missing decorator. No public exploit code or active exploitation has been identified at time of analysis, but the trivial exploitation conditions (no credentials, no special configuration) make this a realistic data-exposure risk for any internet-facing CSZ CMS deployment.

Unauthenticated remote access to invoice PDFs in IDURAR ERP CRM 4.1.0 and earlier exposes customer PII due to the /download Express router being mounted globally without authentication middleware, constituting a broken access control flaw (CWE-284). Any internet-reachable attacker can retrieve financial documents by enumerating MongoDB ObjectIds, requiring no credentials, session token, or user interaction. No active exploitation has been confirmed via CISA KEV, and no public exploit code is identified in the available intelligence, though the attack requires only basic HTTP requests and ObjectId pattern knowledge.

Broken access control in Ghost Foundation Ghost 5.x enables any authenticated Author-role user to delete posts owned by other users, including content published by Editors and Administrators. The authorization failure originates in the post model's permissible() cascade, where the combined isAuthor-and-isDestroy condition is not handled, causing the guard to fall through and approve the deletion. No public exploit code has been identified at time of analysis, but the low attack complexity and minimal privilege requirement mean the flaw is trivially abusable by any Author-role account holder on the platform.

Broken access control in BadChoice Handesk (all versions through 2026-07-10) permits any authenticated agent to modify, escalate, or corrupt ticket records belonging to teams they have no membership in, by directly targeting the TicketsController@update endpoint. The endpoint performs neither an authorize() policy check nor a team-scoped ownership validation, meaning a low-privilege agent account is the only barrier to cross-team data tampering. No public exploit has been identified at time of analysis, but exploitation requires only a valid agent credential and a single crafted HTTP request, making this a low-friction privilege abuse risk in any multi-team deployment.

Cross-team lead record overwrite in BadChoice Handesk (all versions through 2026-07-10) is exploitable by any authenticated agent via the LeadsController@update endpoint, which performs no team-ownership authorization check. The Lead model's $guarded property is set to an empty array, disabling Laravel mass-assignment protection and allowing the attacker to set any column value on any lead record regardless of team boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:L/AC:L vector makes this trivially exploitable by any insider or compromised agent account in a multi-team deployment.

Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.