Authentication Bypass

reCAPTCHA v3 bot protection in the Grav Form plugin (getgrav/grav-plugin-form) 8.0.6 through 9.1.19 can be fully bypassed by an anonymous remote attacker who submits a token under the wrong field name. Because the plugin picks which reCAPTCHA validation branch to run based only on which response field key appears in the payload, sending a v3 token in the v2 field (g-recaptcha-response) forces the v2 code path, which never checks the risk score threshold or the expected action. There is publicly available advisory detail from VulnCheck but no public exploit identified at time of analysis and no evidence of active exploitation.

Client-certificate authentication (mTLS) in Traefik before v2.11.55 can be silently bypassed by unauthenticated network attackers when routers are configured with multiple hostnames bearing conflicting TLS options. Traefik's conflict resolution logic incorrectly falls back to default (non-mTLS) TLS settings for all hostnames in the affected multi-host router, allowing an attacker to reach mTLS-protected backends without presenting a valid client certificate. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific deployment configuration being present.

Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.

Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route protected by the digestAuth middleware. The flaw stems from the middleware returning an empty secret for unknown usernames rather than rejecting them, so an attacker can craft a mathematically valid digest response from that empty secret and arbitrary credentials. Reported by VulnCheck with a fix in v2.11.55; no public exploit identified at time of analysis, though the trivial nature of the bypass makes weaponization straightforward.

phpMyFAQ before 4.1.8 allows an authenticated attacker who has hijacked a user's session to silently strip two-factor authentication (TOTP) protection from any account, including administrator accounts, by calling either POST /api/user/remove-twofactor or PUT /api/user/data/update with only a valid session cookie and CSRF token - no password re-entry or current TOTP code is required. The root cause is CWE-308: the application guards a security-downgrade operation with single-factor controls (session identity plus CSRF) rather than requiring the second factor whose removal is being requested. After TOTP is disabled, the targeted account becomes accessible via password-only authentication, negating the deployment's MFA posture. No public exploit code or CISA KEV listing has been identified at time of analysis.

Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.

Schema validation bypass in fastify before 5.12.2 allows unauthenticated remote clients to reach route handlers that were explicitly configured to reject all input. When a developer assigns the JSON Schema Draft 7 boolean false as a route's body, querystring, params, or headers schema - a valid pattern meaning 'deny every instance' - fastify evaluates it as JavaScript falsy and skips validator compilation entirely, effectively nullifying the intended deny-all gate. Any attacker aware of such routes can send arbitrary requests that bypass what the application believed was an airtight access control, enabling unauthorized state changes or execution of operations the developer intended to disable. No public exploit has been identified at time of analysis, but exploitation is trivially simple once a vulnerable route is discovered.

Remote code execution and full site takeover affect the AI Website Builder WordPress plugin (GitHub build 1.0.0), whose REST API routes perform no authorisation or nonce validation. Unauthenticated attackers can install and activate arbitrary plugins and themes, import content from a URL they control, write an arbitrary file into wp-content/uploads, and delete site content and media - any of the code-installation paths yields RCE, and the arbitrary uploads file write is directly RCE on hosts that serve PHP from the uploads directory. No public exploit identified at time of analysis, but the trivial unauthenticated network attack surface (CVSS 9.8) makes this a critical-priority issue for any site running the affected build.

Authentication hook bypass in Fastify 4.0.0-5.12.1 allows unauthenticated network attackers to reach a private plugin's custom not-found handler by sending a malformed URL under a sibling public plugin's prefix. The internal not-found router dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring plugin-prefix scoping and skipping the preHandler lifecycle - the mechanism most Fastify applications use to enforce JWT or session authentication. No public exploit code has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector means any reachable Fastify deployment meeting the required architecture is exploitable without friction.

Path-based access-control bypass in @fastify/middie (Fastify's Express-style middleware engine) versions 9.1.0 through 9.3.3 lets an unauthenticated remote attacker skip path-scoped middleware - including authentication and authorization - by sending an absolute-form request target. Middie matches middleware against the raw request target while the Fastify router resolves absolute-form targets to their path before dispatch, so the handler runs but the guarding middleware does not. No public exploit was identified at time of analysis, but the flaw is trivially triggerable and remediated in 9.3.4.

Unauthenticated device login in XING Inc.'s CPTrans-ME-X AV signal-transport appliance is possible via a hard-coded password (CWE-259): anyone who knows the built-in credential can authenticate over the network and gain full control of the device. The flaw was coordinated through JPCERT/CC (JVN JVN32505330) and carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the product is niche, but the fixed credential makes exploitation trivial once the value is known.

Hard-coded credentials in Lightstar's SmartIT Desktop Manager allow unauthenticated remote attackers to authenticate with a fixed, built-in password and gain remote access to managed user hosts. Reported through TWCERT, the flaw affects all currently listed versions of the product with no version qualifier in the CPE. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation path (a static shared secret) makes weaponization straightforward once the credential is disclosed.

Credential disclosure in Lightstar's SmartIT Desktop Manager lets unauthenticated remote attackers extract the SSH service-account username and password for the SmartIT Agent directly from the shipped application source code (CWE-798). Because the same hard-coded SSH credentials are reused across deployments, recovering them once yields authenticated SSH access to managed agents, enabling remote command execution and full compromise of endpoints under management. No public exploit has been identified at time of analysis, but retrieval requires no more than reading the product's own code.

Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis.

WHMCS's 2Checkout payment gateway endpoint exposes customer data to unauthenticated remote attackers due to a missing authorization check (CWE-862) across versions 8.13.0 through pre-8.13.8, 9.0.0 through pre-9.0.8, and all end-of-life releases from 4.5.0 onward. The flaw enables an unauthenticated network attacker who meets specific deployment conditions - the 2Checkout payment gateway must be configured and active - to retrieve WHMCS customer records through the unprotected endpoint. Vendor-released patches are available as WHMCS 8.13.8 and 9.0.8; no public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 lets any actor that can reach the server's Server-Worker transport port send crafted messages to the /friend/process endpoint and execute arbitrary code in the PowerJob process context; the assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the root cause class is CWE-287 improper authentication. Publicly available exploit code exists (a PoC repository and a gist are linked from the CVE record), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is 0.62% (47th percentile), notably low relative to the 9.8 severity because exploitation is gated by network exposure rather than by any authentication or user-interaction prerequisite. Realistic risk therefore concentrates on flat networks, cloud deployments that publish the transport port (including default docker-compose setups), and post-perimeter attackers, while well-segmented deployments that keep worker communication internal are substantially less exposed.

Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.

Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.

Privilege elevation in Microsoft Azure Active Directory B2C lets an unauthenticated remote attacker abuse a user-controlled key (CWE-639) to bypass authorization checks and gain elevated privileges across a network. The flaw carries a maximum CVSS 10.0 with a changed scope, reflecting that a successful attack against the shared identity platform can compromise the confidentiality and integrity of resources belonging to other principals or tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.

Privilege elevation in Microsoft's Azure AI Language cloud service lets a remote, unauthenticated attacker reach a critical function that lacks authentication (CWE-306), gaining elevated privileges over the network. Rated CVSS 10.0 with a scope change (S:C), the flaw is disclosed and fixed by Microsoft via MSRC; no public exploit code or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.

Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel and gain elevated privileges over the network. The flaw affects Microsoft's cloud identity-and-access-management service, which underpins sign-in and authorization for Microsoft 365, Azure, and countless federated third-party applications. No public exploit identified at time of analysis and SSVC records exploitation status as none, but the CISA SSVC framework rates the attack as automatable with total technical impact.

Remote process termination in MOOS core-moos through 10.4.0 allows any multicast-reachable attacker to forcibly shut down arbitrary MOOS processes by exploiting a hard-coded passphrase embedded in the SuicidalSleeper component. The passphrase 'elks have been know to waltz' was compiled directly into SuicidalSleeper.cpp and is publicly visible in the open-source repository, enabling unauthenticated adjacent attackers to enumerate running MOOS processes and issue termination commands via the default multicast group and port. No public exploit has been identified at time of analysis, but the static passphrase effectively eliminates any practical authentication barrier for multicast-adjacent peers.

Unauthorized runtime route reconfiguration in MOOS essential-moos pShare through 10.0.1 lets any client of the MOOS database issue PSHARE_CMD messages to open new listeners and redirect or duplicate inter-process bus traffic. Because pre-patch builds unconditionally subscribed to PSHARE_CMD, a remote unauthenticated attacker able to publish to the MOOSDB could reroute or mirror sensor/control traffic to attacker-controlled destinations without any credentials. The vendor patch (PR #20) is available and a source-level fix is confirmed, but no public exploit or active exploitation is identified at time of analysis.

MOOSDB in core-moos through 10.4.0 accepts wire-supplied source identifiers verbatim instead of enforcing the authenticated connection identity, enabling any authenticated MOOS client to forge message origins and impersonate arbitrary registered processes within the broker. Exploitation allows an attacker to attribute writes to a victim client and invoke subscription cancellations as if originating from that client, corrupting the publish-subscribe integrity of the entire MOOS community. No active exploitation has been confirmed (not in CISA KEV), but the vulnerable code path is fully exposed by the published fix in GitHub PR #76, making the flaw straightforward to exploit for any connected attacker.

Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to send crafted UDP packets that pShare republishes verbatim to the local MOOS community under an attacker-chosen identity, or to crash the pShare bridge process with malformed payloads. The root flaw is that pShare's Listener class used raw socket reads without capturing the sender's address, performing no source validation before deserializing and forwarding messages as authoritative MOOS community traffic. A fix is available in upstream commit 53729b6 and PR #18, which adds allowlist-based source filtering and wraps deserialization in exception handling; no public exploit code has been identified and the CVE is not in CISA KEV.

Unauthenticated variable write in MOOS core-moos through 10.4.0 lets any client that can reach the optional MOOSDB HTTP server port set arbitrary MOOS variables - including actuator and override commands - because the web server enforces no credential of any kind. In vulnerable builds the HTTP 'poke' path is always live, so a single crafted GET/POST can alter the shared runtime blackboard that drives autonomous-vehicle behavior. Reported by VulnCheck with a vendor patch available (PR #77 / commit 7e3aecd); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated full compromise of the MOOSDB message bus in MOOS core-moos through 10.4.0, where the wire protocol performs no client authentication. Any attacker who can reach the MOOSDB TCP port can bypass the compile-time protocol-string check, connect under an arbitrary client name, and gain unrestricted publish, subscribe, and administrative privileges - including the DB_CLEAR operation that wipes all variables and client mail queues. VulnCheck reported the flaw and an upstream fix (shared-key handshake) exists in PR #84; no public exploit has been identified at time of analysis, though the attack is trivial to script.

Hardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret directly in application source code, allowing unauthenticated remote access to IBM's private container registry. An attacker who obtains the credential - likely by inspecting distributed software artifacts or container image layers - can pull private images, potentially revealing proprietary application code, embedded configuration values, and additional secrets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

System access-restriction bypass in Google Chrome's Network component (versions prior to 152.0.7977.82) lets a remote attacker use crafted network traffic to circumvent enforced access controls, stemming from incomplete resource cleanup (CWE-459). The flaw carries a Chromium-rated High severity and a CVSS of 9.1 reflecting high confidentiality and availability impact; no public exploit is identified at time of analysis and EPSS is low (0.22%). Google fixed it in the 2026-09 stable desktop channel update.

Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions through 0.5.5 lets any remote attacker impersonate arbitrary users. The application's docker-compose.yml ships a hardcoded JWT signing secret that is public in the project repository, so an attacker who knows the secret can mint valid tokens for any user ID - including administrators - and reach protected API endpoints without credentials. Reported by VulnCheck; no public exploit identified at time of analysis, though the 'exploit' is trivially the published secret itself.

Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privilege user to perform administrative actions reserved for admins. Authenticated user-role accounts can create maintenance windows that silence monitoring alerts across all monitors, tamper with notification channel configurations, and delete monitor check history to destroy incident evidence. No public exploit identified at time of analysis, though the vulnerability is documented in a public GitHub issue and a VulnCheck advisory, making opportunistic exploitation by insiders or compromised accounts plausible without further development effort.

Unauthenticated arbitrary file upload in GeoNetwork prior to versions 4.4.12 and 4.2.17 allows remote attackers to write malicious XSLT or ZIP formatter files directly to the server's formatter directory without any authorization check. Because GeoNetwork processes uploaded `.xsl` formatter files server-side via a Java XSLT engine when rendering metadata records, attackers can weaponize this upload into a remote code execution chain by embedding Java extension function calls within the XSLT payload. No public exploit has been confirmed at time of analysis, but The Hacker News coverage explicitly frames this as unauthenticated RCE, and the exploitation path (malicious XSLT to Java extension-function execution) is a well-documented Java attack technique.

Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack vector makes this trivially exploitable by automated scanners.

Missing authorization in the YITH Request a Quote for WooCommerce Premium plugin (all versions before 4.46.0) lets unauthenticated attackers reach functionality that should be access-controlled, per a Patchstack advisory. The flaw is a broken-access-control / missing-authorization issue (CWE-862) rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory does not detail the exact vulnerable action.

Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unlimited OTP brute-force against MISP's email-based two-factor authentication allows an attacker holding valid primary credentials to bypass the second factor and fully compromise a target account. The email_otp() endpoint applied no rate limiting or lockout, and the OTP is scoped to the user rather than the login session - enabling multiple concurrent sessions to hammer the same valid OTP simultaneously. Patch available via commit 8658062ea; no public exploit identified at time of analysis.

Authentication bypass in CRMEB through v6.0.0 allows any low-privileged authenticated user - including sub-administrators and accounts carrying no assigned roles - to access restricted admin endpoints. The root cause is a structurally broken role-check implementation in the verifyAuth() method of SystemRoleServices.php, where both conditional branches unconditionally return true, rendering the authorization gate completely inert. VulnCheck has published a dedicated advisory and the flaw is documented in a public GitHub issue (#119), but no CISA KEV listing or confirmed active exploitation has been identified at time of analysis.

Session cookie forgery in Dianping CAT (Central Application Tracking) through version 3.1.0 lets remote unauthenticated attackers mint valid administrator sessions. The server uses Java's String.hashCode() as the only integrity check on session cookies without any server-side secret key, so an attacker can compute a matching checksum entirely offline; combining this with a spoofed x-forwarded-for header to defeat IP-binding validation yields a full-access admin session over CAT's configuration. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the technique is fully documented in the advisory and the vulnerable code (TokenBuilder.java, HttpUtils.java) is public.

Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.

Missing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2StoreControllerApps` `appTask` delegation path - which instantiates app-plugin controllers with no ACL check - and drive `applocalizationdata::getInstallerTool()` with a caller-influenced, non-allow-listed table name to truncate `#__j2store_*` tables and construct a path-traversal-capable path to SQL files it then executes. This yields a file-read/execute primitive affecting J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. There is no public exploit identified at time of analysis, and access is currently blocked only as an accidental side effect of an `fof.xml` wildcard-deny rather than a deliberate control.

Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 release lines via an unoverridden inherited FOF framework `save` task reachable by unauthenticated front-end requests. The controller correctly restricted `remove()` to the caller's own session but never overrode the generic FOF `save` task, leaving it exposed to unauthenticated `format=raw` POST requests that can insert new cart rows with attacker-chosen `user_id`/`session_id` values or overwrite existing rows by numeric ID. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity network vector makes this trivially exploitable against any publicly reachable J2Store storefront.

SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though NCSC.ch has reported the issue, suggesting coordinated disclosure with the Swiss vendor.

Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'

Authentication bypass in self-managed Grafana allows a low-privileged, already-authenticated user to be resolved as a different — potentially higher-privileged — user, up to Grafana Administrator, when Auth Proxy authentication is combined with identity caching (sync_ttl greater than zero). The flaw is a cache-key collision: the identity cache concatenated the username and forwarded proxy attributes without a delimiter, so crafted attribute values can produce the same key as a victim's cached entry. Only self-managed Grafana OSS and Enterprise deployments behind an Auth Proxy with caching enabled are affected; Grafana Cloud, default configurations, and instances without Auth Proxy caching are not. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low (0.34%, 27th percentile) despite the high CVSS base of 8.1.

Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.

NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.

Authentication bypass in the Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) allows any authenticated low-privilege user to overwrite the SAML identity provider metadata file via unrestricted Stapler data binding, replacing it with attacker-controlled content. Once the IdP metadata is replaced, the attacker operates their own SAML authority and can issue assertions claiming any Jenkins user identity - including administrator - granting full platform compromise. No active exploitation is confirmed (not in CISA KEV), and no public POC has been identified at time of analysis.

Privilege escalation in the Motorola Smart Connect mobile application stems from insufficient authorization controls (CWE-862) on the dashboard UI, which can be manipulated by third-party applications installed on the same device. When paired with a phishing attack targeting the device user, this manipulation enables an attacker to escalate privileges within the device or connected system. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.

Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core.

Privilege escalation in Craft CMS before 5.10.11 allows authenticated non-admin users holding the administrateUsers permission to perform a full control-panel takeover by minting valid password reset URLs for administrator accounts. The actionGetPasswordResetUrl endpoint omits a check that the caller holds admin status, and the downstream actionSetPassword endpoint validates only the cryptographic verification code without inspecting the caller's session - meaning any valid reset token is redeemable regardless of who requested it. No public exploit or KEV listing exists at time of analysis, but the attack is mechanically straightforward for any user who has been delegated the administrateUsers permission.

libcurl's SASL state machine for LDAP authentication incorrectly treats an incomplete cryptographic handshake as a fully verified authentication exchange, allowing a Man-in-the-Middle attacker to inject a premature termination message that bypasses peer validation entirely. All curl releases from 7.82.0 through 8.21.0 are affected, spanning a multi-year release history documented in EUVD-2026-72164 and the curl project's own advisory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though successful exploitation grants an attacker the ability to intercept LDAP credentials and inject falsified directory responses.

Public key pinning enforcement in libcurl (versions 7.45.0 through at least 8.21.0) is silently bypassed when CURLOPT_PINNEDPUBLICKEY is combined with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 - the exact configuration adopted by applications that rely on pinning as their sole TLS trust anchor after disabling standard certificate chain validation. When a server presents no certificate at all, libcurl's pin-check code path is never reached and the connection succeeds, enabling a network-positioned attacker to conduct MITM attacks against applications that believed pinning would protect them. No public exploit is identified at time of analysis and EPSS stands at 0.14% (4th percentile), indicating limited opportunistic exploitation activity despite the broad version range affected.

Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patches are available as of September 2, 2026.

Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. A publicly available proof-of-concept exploit reported by WPScan materially elevates real-world risk and makes this an immediate patching priority for affected sites.

Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. A publicly available proof-of-concept from WPScan exists and a vendor patch is available at version 0.9.2.7.

Unauthenticated access to the internal organization loadOrSearch endpoint in APITable through 1.13.0-beta.1 exposes complete workspace member directories-including names, email addresses, and team hierarchy-to any remote attacker who possesses a valid space identifier. Space identifiers are trivially obtainable from shared links or public templates, making this effectively a zero-prerequisite information disclosure against any APITable deployment with sharing enabled. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires only standard HTTP tooling and no credentials.

Unauthenticated remote access to PikiwiDB (Pika) v3.5.7's internal protobuf replication server allows attackers to exfiltrate complete database snapshots and intercept live write streams without any credentials. The replication port - exposed on a fixed, predictable offset from the client port (default 11221) - routes TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests directly without requiring a prior authenticated MetaSync handshake, rendering the requirepass/masterauth configuration control entirely ineffective. No active exploitation is confirmed at time of analysis, but the remote, unauthenticated, low-complexity attack path makes this a high-priority exposure for any deployment where the replication port is reachable from untrusted networks.

Authentication bypass in Team Password Manager before 14.184.308 lets unauthenticated remote attackers abuse the local account password-reset flow to set arbitrary passwords for existing local users and then log in as them. Because this product is a self-hosted vault storing credentials for entire teams, a successful reset yields full account takeover and access to whatever secrets the victim can view. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck and a fixed release is available.

Firmware-level compromise of the Phison PS3111-S11 SATA SSD controller allows an attacker with privileged local host access to read and write controller SRAM and raw NAND flash by abusing privileged vendor unique commands (VUCs) exposed over the ATA interface. Firmware builds through SBFQT1.3 either ship with no VUC lock or use a weak CRC-16 unlock handshake that can be trivially defeated, enabling a persistent firmware implant that survives power cycles and OS reinstalls. Public tooling and a technical writeup exist (VulnCheck advisory plus GitHub 'disksec' and 'psychite' projects), so publicly available exploit code exists, though there is no evidence of active exploitation.

Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox via a crafted local program, affecting all Chrome for Windows versions prior to 152.0.7977.75. The root cause is incorrect authorization (CWE-863) within the Chromoting subsystem, where flawed authorization logic fails to restrict a local program from interacting with Chromoting in a way that crosses the sandbox boundary. Google has released a patched version (152.0.7977.75), and no public exploit has been identified at time of analysis, though the full post-sandbox C:H/I:H/A:H impact warrants prompt remediation.

Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.

Rate-limit bypass in WWBN AVideo (all versions) allows unauthenticated remote attackers to perform unlimited credential-guessing against login endpoints by rotating arbitrary X-Real-IP or X-Forwarded-For header values per request. The enforceRateLimit() function uses the attacker-supplied header as the client identifier without verifying the request originates from a trusted proxy, nullifying IP-based throttling entirely. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond basic HTTP scripting.

Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.

Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.

Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.

Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.

Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.

Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.

Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.

Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.

Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.

Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.

Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.

Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.

Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Dell PowerStore SDNAS (software-defined NAS) on PowerStoreOS builds earlier than 4.3.1.2-2771239 exposes a critical function that performs no authentication check, so an unauthenticated remote attacker who can reach the array's NAS service can gain full filesystem access - reading, modifying, or destroying stored data with no credentials and no user interaction (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Realistic exploitation is bounded by network position: PowerStore is a datacenter storage appliance whose NAS and management interfaces are normally segmented and not internet-facing, so an attacker would generally need pre-existing access to the storage or management network segment that can reach SDNAS. No public exploit code has been identified, CISA SSVC rates exploitation as 'none', EPSS is 0.27% (20th percentile), and a vendor patch (PowerStoreOS 4.3.1.2-2771239 or later) is already available per Dell advisory DSA-2026-330.

Unauthenticated QoS configuration injection in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers push attacker-controlled Quality-of-Service settings to the master node by sending a crafted MQTT message to the cs_broker component's sendToMasterQosConfig handler. Because the handler performs no authentication or access-control check, any party able to reach the MQTT broker can alter traffic-shaping/prioritization policy across the managed mesh. No public exploit identified at time of analysis, and EPSS is low (0.18%), indicating no observed mass exploitation yet.

Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers restart the cloud update check workflow by sending a crafted MQTT message to the exposed cs_broker component. The remoteCloudUpdateCheck handler performs no authentication before acting on broker messages, so anyone able to reach the broker can repeatedly trigger the workflow. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating no evidence of mass exploitation.

Unauthenticated modification of privileged QoS policy is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 via the setElinkQosConfig function, reachable by sending a crafted MQTT message to the cs_broker component without any credentials. The access control check is entirely absent for this function, exposing a privileged network management operation to any attacker who can reach the MQTT broker over the network. No public exploit code has been identified and EPSS is very low at 0.18%, but the zero-barrier AV:N/PR:N exploit path makes this a practical integrity risk for any deployment with an externally or LAN-exposed MQTT port.

Unauthenticated device reboot and pairing-state reset affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) via its recvClearPairCfg handler, which processes MQTT messages to the cs_broker component without verifying the sender's authorization. A remote attacker who can reach the MQTT broker can send a crafted message to wipe the device's pairing state and force a reboot, disrupting connectivity. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with SSVC exploitation status of 'none'.

Quadratic-time CPU exhaustion in Red Hat OpenShift Container Platform 4's OAuth login and error page endpoints allows unauthenticated remote attackers to deny authentication to all cluster users simultaneously. The attack exploits a bypass of the CVE-2022-32149 mitigation in golang.org/x/text/language.ParseAcceptLanguage(): the existing guard checks for hyphen ('-') character counts, but the BCP 47 scanner internally aliases underscore ('_') to '-' after the guard executes, allowing a crafted Accept-Language header with underscore subtag separators to slip through and trigger unbounded quadratic-time parsing. No public exploit has been identified at time of analysis, though the bypass mechanism is fully documented in the CVE description, meaningfully lowering the bar to exploitation.

Authenticated IDOR in GROWI through v8.0.2 exposes revision content from access-restricted pages via the GET /_api/v3/revisions/:id API endpoint. The endpoint performs its access check against a caller-supplied query parameter (page identifier) but returns the revision record identified by the URL path parameter without verifying both identifiers resolve to the same page. Any authenticated user can pair a page ID they legitimately access with an arbitrary revision ID from a private or restricted page to silently exfiltrate its historical content. No public exploit is identified at time of analysis; CVSS 4.0 scores this 7.1 with high confidentiality impact and no integrity or availability loss.

Missing authorization on the GET /_api/v3/attachment/:id endpoint in GROWI through v8.0.2 allows any authenticated user to retrieve attachment metadata - including original filenames and file formats - from pages they have no permission to view. The root cause (CWE-862) is an omitted page-viewer access check that the sibling /attachment/list endpoint already enforces, confirmed by VulnCheck and the upstream patch PR. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially mounted by any valid GROWI session holder who can enumerate attachment identifiers.