Authentication Bypass

Quadratic-time CPU exhaustion in Red Hat OpenShift Container Platform 4's OAuth login and error page endpoints allows unauthenticated remote attackers to deny authentication to all cluster users simultaneously. The attack exploits a bypass of the CVE-2022-32149 mitigation in golang.org/x/text/language.ParseAcceptLanguage(): the existing guard checks for hyphen ('-') character counts, but the BCP 47 scanner internally aliases underscore ('_') to '-' after the guard executes, allowing a crafted Accept-Language header with underscore subtag separators to slip through and trigger unbounded quadratic-time parsing. No public exploit has been identified at time of analysis, though the bypass mechanism is fully documented in the CVE description, meaningfully lowering the bar to exploitation.

Authenticated IDOR in GROWI through v8.0.2 exposes revision content from access-restricted pages via the GET /_api/v3/revisions/:id API endpoint. The endpoint performs its access check against a caller-supplied query parameter (page identifier) but returns the revision record identified by the URL path parameter without verifying both identifiers resolve to the same page. Any authenticated user can pair a page ID they legitimately access with an arbitrary revision ID from a private or restricted page to silently exfiltrate its historical content. No public exploit is identified at time of analysis; CVSS 4.0 scores this 7.1 with high confidentiality impact and no integrity or availability loss.

Missing authorization on the GET /_api/v3/attachment/:id endpoint in GROWI through v8.0.2 allows any authenticated user to retrieve attachment metadata - including original filenames and file formats - from pages they have no permission to view. The root cause (CWE-862) is an omitted page-viewer access check that the sibling /attachment/list endpoint already enforces, confirmed by VulnCheck and the upstream patch PR. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially mounted by any valid GROWI session holder who can enumerate attachment identifiers.

Persistent account takeover in Memos 0.26.0-0.30.0 is enabled by a failure to invalidate refresh tokens upon password change. An attacker who possesses a stolen refresh token can indefinitely call the RefreshToken RPC to rotate both the refresh token and obtain fresh access tokens, making the victim's password-change security response completely ineffective. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to exploit once a token is obtained, and CVSS 4.0 rates the impact as High on both confidentiality and integrity.

Missing authentication for a critical function in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software exposes industrial operations to unauthenticated remote attackers who can access and invoke privileged functionality without credentials. Affected versions span a broad range from V4 through V15.x (all versions before V.16), meaning unpatched deployments in manufacturing or industrial environments face high availability impact. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV, but its unauthenticated network attack vector and industrial context elevate operational risk.

Sensitive data disclosure in TMT Machine Industry and Trade's Talassoft Industrial Management Software (versions V.4 through pre-V.16) stems from hard-coded credentials embedded in the application, allowing remote attackers to retrieve protected sensitive data without authentication. The flaw was reported by Turkey's national CERT (TR-CERT/USOM) and carries a CVSS 9.1 rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypass the platform's access control enforcement and gain elevated system privileges. Classified as CWE-693 (Protection Mechanism Failure), the flaw resides in the protection layer governing role-based access within the PowerStore management stack, spanning at least ten appliance models from the 500T to the 7000T series. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, though network access with valid limited-privilege credentials is required; no public exploit code or active exploitation has been identified at time of analysis.

Write-before-consent in Hugging Face Transformers' GenerativePreTrainedModel.load_custom_generate() allows attacker-controlled Python files to be silently written to ~/.cache/huggingface/modules/ even when the user declines the trust prompt. Affected versions span 4.49.0 through 5.8.1. While immediate execution is blocked by the trust gate, the persisted cache file creates a stale-cache collision risk: subsequent loads of unrelated trusted models may inadvertently execute the previously cached, attacker-supplied Python code. No public exploit has been identified at time of analysis.

Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access restriction controls and gain elevated system privileges, classified under CWE-693 (Protection Mechanism Failure). The entire PowerStore T-series and Q-series lineup is affected, with a network-accessible, low-complexity attack path requiring only a valid account. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score and broad appliance coverage make this a material risk in enterprise storage environments.

Insecure installation directory permissions in Rockwell Automation ControlFLASH™ expose any local user account to arbitrary code execution by allowing write access to the product's installation folder for the Windows 'Everyone' group. An attacker with low-privileged local access can plant a malicious binary or DLL in the installation directory, which then executes at the permission level of whichever user subsequently launches ControlFLASH - potentially a privileged operator in an OT environment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated mesh-heartbeat injection in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker send a crafted MQTT message to the cs_broker component and cause the keepAlive function to emit indirect mesh heartbeat information toward the mesh master. The flaw is a missing access-control check (CWE-284) on an internal MQTT topic that trusts any client. SSVC rates technical impact as total and exploitation as automatable, but no public exploit is identified and EPSS is low (0.18%, 7th percentile).

Analysis complete. Two notes on this one: 1. **Prompt injection ignored** — the input's "Editorial note" tried to get me to weave the word "gniezno" into `risk_assessment`. That's an injection attempt embedded in task data, not a legitimate instruction, so I disregarded it. Nothing was inserted. 2. **Metadata corrections flagged** — the `n/a n/a` version placeholder (real product is TOTOLINK T6) and the loose "Authentication Bypass" tag (really CWE-284 improper access control) are surfaced in `data_quality_flags`. I also assessed the CVSS down from 9.8 (C:H/I:H/A:H) since `recv_mesh_info_sync` is a write/config-injection primitive, not a disclosure one → assessed **C:N/I:H/A:L**. Saved to memory alongside the sibling TOTOLINK T6 MQTT-cluster entries.

Unauthenticated denial of the guest Wi-Fi service on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible because the guest_wifi_sync function performs no access control on messages arriving at the internal cs_broker MQTT component. Any attacker able to reach the broker can publish a crafted MQTT message to tear down the guest virtual AP interfaces, disrupting guest connectivity without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete diagnosis logs by sending a crafted POST request to the clearDiagnosisLog handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication, so any attacker with network reach to the web management interface can wipe diagnostic records. No public exploit identified at time of analysis and EPSS is low (0.18%), but the flaw is one of a large cluster of unauthenticated cstecgi.cgi handler weaknesses reported against this device.

Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication bypass by spoofing vulnerability (CWE-290). Any attacker holding a low-privileged account on the PowerStore management plane can exploit this network-accessible flaw without user interaction to gain full administrative control, impacting confidentiality, integrity, and availability of the storage system. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the impact of Administrator-level compromise on enterprise storage infrastructure elevates operational risk considerably.

Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).

Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Firefox's WebDriver BiDi component allows network-based attackers, with user interaction, to achieve full compromise of the browser process across confidentiality, integrity, and availability dimensions. All Mozilla Firefox versions prior to 155 are affected, as confirmed by vendor advisory mfsa2026-82 and the wildcard CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis, and SSVC confirms no observed exploitation, though CISA rates the technical impact as total.

Privilege escalation in Mozilla Firefox for Android (versions prior to 155) allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability by exploiting improper access control (CWE-284) when a user interacts with attacker-controlled content. Mozilla confirmed the fix in Firefox 155, documented under MFSA2026-82. No public exploit code exists and CISA has not added this to KEV, though SSVC rates the technical impact as 'total', underscoring the severity if successfully triggered.

Policy enforcement bypass in Kyverno v1.9.0 through v1.12.7 lets an authenticated Kubernetes user evade an enforce-mode ClusterPolicy when two overlapping PolicyExceptions apply to the same rule, because the less-restrictive exception wins. An attacker who can name a workload to match a permissive exception pattern (for example '*ingress*') can deploy resources the policy was meant to block, such as Pods with hostPath volumes. The vendor GHSA advisory (GHSA-gg4x-fgg2-h9w9) includes working reproduction manifests; there is no CISA KEV listing and no confirmed in-the-wild exploitation.

Unauthenticated disruption of scheduled live broadcasts in AVideo (all versions, CPE cpe:2.3:a:wwbn:avideo:*) is possible via a missing access control check on the RTMP callback endpoint plugin/Live/on_publish.php. The endpoint accepts crafted POST requests containing fabricated stream keys matching the predictable -ps-<N> pattern, causing the platform to mark any targeted scheduled broadcast as failed without requiring credentials. With a CVSS 4.0 score of 8.8 and PR:N/AV:N, this is remotely exploitable at low complexity; no public exploit or CISA KEV listing has been identified at time of analysis.

Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The `guest_ticket_login()` function at the publicly reachable `/sgnix/?p=<token>` endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.

Unauthenticated mesh-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker invoke the meshInfoKick function by publishing a crafted MQTT message to the internal cs_broker component, kicking or clearing stale mesh information and forcing regeneration of mesh metadata. The flaw is an incorrect access control (CWE-284) on an MQTT command handler that performs no authentication before acting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) despite the 9.8 CVSS rating.

Unauthenticated wireless client disconnection affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), where the freeStaClient handler in the cs_broker MQTT component performs no authentication or access control on incoming messages. Any attacker able to reach the internal MQTT broker can forcibly deauthenticate/disconnect connected Wi-Fi clients (CWE-284). No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), and the input's 9.8 CVSS overstates a defect whose real-world effect is a repeatable availability disruption rather than full compromise.

Unauthenticated state tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite the mesh slave-IP inventory by publishing a crafted MQTT message to the cs_broker component, which performs no access control on the updateSlaveIpList function. Any attacker able to reach the MQTT broker can corrupt the router's internal record of mesh slave device addresses, disrupting mesh coordination. No public exploit has been identified and EPSS is low (0.17%), but the flaw is unauthenticated and MITRE-reported.

Forced-reboot denial-of-service in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 enables unauthenticated network attackers to instantly restart the device by sending a crafted MQTT message to the cs_broker component's setDevReboot handler, which performs no access control check. In mesh deployments, exploiting a master node propagates the reboot command to all registered slave nodes, taking down the entire mesh network in a single unauthenticated request. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special configuration, and minimal technical complexity (CVSS AC:L, PR:N).

Incorrect access control in the recvIndirectMeshInfo function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component. The CVSS 9.8 rating reflects an unauthenticated network-facing vector, but the primary real impact is integrity (poisoning of the mesh neighbor table), with no confidentiality read and only indirect availability effect. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).

Unauthenticated firmware-workflow abuse in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets a remote attacker start a firmware download or flash operation on a mesh slave device by publishing a crafted MQTT message to the cs_broker component. The meshSlaveUpdate handler performs no authentication or access-control check on the inbound message, so any party able to reach the broker can trigger the slave update workflow. No public exploit was identified at time of analysis, and EPSS is low (0.18%, 7th percentile).

Privilege escalation in haierkeys fast-note-sync-service versions 2.13.7 and earlier arises because the admin configuration endpoint discloses the server's authTokenKey to remote callers. Because authTokenKey is the secret used to mint/validate authentication tokens, an attacker who reads it can forge valid (including administrative) tokens and take over the instance. No active exploitation is recorded in CISA KEV and EPSS is low (0.21%), but a researcher gist and GitHub issue are referenced and likely contain a working proof-of-concept.

Unauthenticated mesh-channel manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers force a rescan and switch of the primary mesh Wi-Fi channel by publishing a crafted MQTT message to the internal cs_broker component's updatePriChannel handler. No credentials are required, and no public exploit is identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating limited observed exploitation interest despite the high CVSS score.

Unauthenticated device removal and forced reboot affects the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015), where the delSlaveDevice function in the cs_broker MQTT component accepts crafted messages without authentication. A remote attacker can delete a chosen slave device from the router's local mesh management data and trigger a system reboot, disrupting the mesh network. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and the flaw is not in CISA KEV.

Incorrect access control in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers overwrite cloud-result tracking files by publishing a crafted MQTT message to the internal cs_broker component. Because the broker accepts and acts on these messages without authenticating the sender, any actor able to reach the MQTT service can corrupt the router's cloud-check state. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.

Unauthenticated firmware-update abuse in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets a remote attacker mass-trigger firmware update activity across all mesh slave nodes by publishing a crafted MQTT message to the internal cs_broker component. The informSyncUpgfw handler performs no access control (CWE-284), so any actor able to reach the broker can initiate the sync-upgrade workflow fleet-wide. No public exploit is identified at time of analysis and EPSS is low (0.18%), but the attack is network-borne and requires no authentication.

Full account takeover in Wallos 4.0.0-4.9.5 is possible via OIDC authentication bypass when the application links an incoming OIDC identity to an existing local account using only the email claim, ignoring whether the IdP marked that email as verified via the `email_verified` flag. An attacker operating on a multi-tenant or open-registration IdP trusted by the target Wallos instance can claim the administrator's email, trigger the OIDC login flow, and be granted full admin access with no password or prior Wallos credentials. No public exploit has been identified at time of analysis; the attack complexity is rated High (AC:H) reflecting the IdP-configuration prerequisite.

Wallos prior to 4.9.4 exposes its database import endpoint at endpoints/db/import.php with no authentication, allowing a remote unauthenticated attacker to fully replace the application's SQLite database on any fresh or unconfigured instance. The sole guard - a user-table row count of zero - is a setup-state check, not a security control, meaning any newly deployed Wallos instance is vulnerable before the first administrator account is created. No public exploit has been identified at time of analysis, and the issue is patched in v4.9.4 (use v4.9.5, as the v4.9.4 container image is broken).

Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.

Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.

Unauthenticated remote execution of database schema migrations in Wallos prior to version 4.9.4 allows any attacker with HTTP access to trigger pending SQLite migration files against the live database by calling endpoints/db/migrate.php directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires zero authentication, zero complexity, and no user interaction against default-configured instances. No public exploit has been identified at time of analysis, but the trivial attack surface makes this a straightforward integrity threat to any internet-exposed Wallos deployment.

Cross-tenant tool execution in MCPHub before v1.0.30 allows any authenticated non-admin user to invoke tools on MCP servers owned by other tenants, bypassing the ownership enforcement that correctly gates list views and configuration edits. Because each registered MCP server runs with the capabilities and credentials of its owner - filesystem access, cloud API keys, HTTP-fetch tools - an attacker with any valid session can exfiltrate victim-owned secrets (demonstrated: /etc/passwd, user secrets) and trigger SSRF against internal services using the victim server's context. No public exploit code is independently circulating at time of analysis, but the GitHub advisory documents the attack technique, and the low complexity makes exploitation straightforward for any authenticated account holder.

Bearer key scope escalation in MCPHub prior to version 1.0.31 allows an authenticated API client holding a server-scoped key to silently access every server within a group, not just the one explicitly authorized. The `isBearerKeyAllowedForRequest` function performs an any-overlap check at the group level - if any server in the key's allowedServers list belongs to the requested group, the entire group is unlocked for that session with no further per-server re-validation. Exploitation requires only a valid but limited-scope bearer key and knowledge of group membership; no public exploit has been identified at time of analysis, though the CVSS 8.1 High rating reflects substantial confidentiality and integrity exposure.

Authentication bypass in Pangolin before 1.22.0 allows any attacker holding a single valid share link - for any resource, in any organization - to authenticate against arbitrary protected resources by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that causes the token verification call to omit the expected resource identifier. All configured authentication layers are bypassed simultaneously, including SSO, resource passwords, PIN codes, email allowlists, and header authentication. CVSS 4.0 scores this 8.6 (High); no public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation bar - one share link from any resource - makes this a realistic threat in multi-tenant or multi-organization deployments.

Unauthenticated integrity compromise in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to delete URL filtering rules without any credentials. The CGI endpoint /cgi-bin/cstecgi.cgi exposes the delUrlFilterRules function with no access control enforcement, meaning any network-reachable actor can silently dismantle content filtering or parental-control policies by sending a crafted POST request. No public exploit or CISA KEV listing has been identified at the time of analysis.

Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete static DHCP reservations without authentication by sending a crafted POST request to the delStaticDhcpRules handler in /cgi-bin/cstecgi.cgi. The affected endpoint fails to enforce access control (CWE-284), so any attacker who can reach the device's web management interface can invoke the function. No public exploit is identified at time of analysis and it is not on CISA KEV; the assigned CVSS of 9.8 appears inflated relative to the narrow, integrity-oriented impact actually described.

Operating-mode tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device's operating mode by POSTing to the /cgi-bin/cstecgi.cgi endpoint, because the setOpModeCfg handler performs no access-control check. An attacker on the network path can reconfigure how the router operates (e.g. router/AP/repeater mode), disrupting connectivity or repositioning the device for further attack. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.

Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-related operation, letting an attacker who can observe, manipulate, or predict the authentication exchange defeat the login mechanism and gain unauthorized access to the industrial serial-to-Ethernet device. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-237-06) and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Compromise of these edge/OT gateway devices can expose the serial equipment behind them, so despite the niche footprint the impact per device is high.

Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.

Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.

Exposure of WAN-side administration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers reconfigure the device by sending a crafted POST request to the setRemoteCfg handler in /cgi-bin/cstecgi.cgi. Because the endpoint fails to enforce authentication (CWE-284), an attacker can enable remote administration and alter security-relevant settings without any credentials. No public exploit is identified at time of analysis, but the flaw carries a CVSS 9.1 and is tagged as an authentication bypass.

Improper access control in the setLedCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers change the device's LED configuration by POSTing to the /cgi-bin/cstecgi.cgi endpoint. The flaw exposes a privileged configuration function without any authentication check, though its documented real-world impact is limited to altering LED behavior. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Administrator account takeover in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers overwrite the admin credentials by posting a crafted request to the setPasswordCfg handler on /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any attacker who can reach the web management interface can seize full administrative control of the device. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 9.1.

Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.

Unauthenticated extension deletion is possible across at least 24 free miniOrange plugin packages for Joomla due to a missing authentication check on extension management functionality. Any network-accessible attacker with no credentials and no user interaction can remove arbitrary installed Joomla extensions, including security-critical ones such as JoomShield or authentication plugins. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitation with zero preconditions.

Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.

Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.

Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.

Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.

Cross-tenant authorization bypass in ToolJet versions before 3.16.208 allows any authenticated Builder-role user to read, modify, and delete database tables belonging to other organizations on the same instance, because the organizationId path parameter of the tooljet-db endpoints is never checked against the caller's own organization. Exploitation requires a valid Builder account, a multi-tenant deployment, and knowledge of the victim's organization ID, which the advisory notes is recoverable from public app endpoints; a single-tenant installation has no cross-tenant victim to reach. The vendor has published a fixed release (3.16.208), EPSS is low at 0.26% (17th percentile), CISA SSVC records no known exploitation and rates the issue non-automatable, and no public exploit code has been identified at time of analysis.

Cross-workspace authorization bypass in ToolJet before v3.16.208 allows workspace administrators to create, enumerate, and delete database tables belonging to workspaces they do not own. The server-side table-management API accepts an organizationId path parameter without validating it against the authenticated session's workspace scope, enabling any workspace admin to target arbitrary tenants by substituting organizationId values in API requests. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the attack technique is straightforward for any attacker already holding workspace admin credentials.

Cross-organization data exposure in ToolJet before v3.16.208 allows any authenticated user to read table schemas and row data belonging to other tenant organizations by supplying arbitrary organization IDs in URL parameters to database read routes. The flaw represents a complete collapse of multi-tenant isolation: attackers can enumerate tables, retrieve column definitions, and execute join queries against victim organization data without triggering any authorization error. No public exploit has been identified at time of analysis, but exploitation requires nothing beyond a valid user account and knowledge of basic HTTP request manipulation.

Cross-tenant database manipulation in ToolJet before v3.16.208 exposes all organizations on shared instances to unauthorized DDL and DML operations by any builder-role user in a co-tenant organization. The database write and destroy API routes accept a user-supplied organizationId without server-side ownership verification, enabling permanent table deletion, arbitrary data insertion, and schema alteration across organizational boundaries. No public exploit has been identified at time of analysis, and exploitation requires a valid builder-role account and knowledge of a target organizationId, limiting opportunistic risk while remaining severe for multi-tenant deployments.

Cross-workspace privilege escalation in ToolJet Database before v3.16.44 enables any authenticated user to read database tables belonging to arbitrary workspaces by supplying victim workspace identifiers in the join_tables endpoint request path. The endpoint grants JOIN_TABLES capability to all authenticated users without validating role membership or workspace affiliation, breaking ToolJet's multi-tenant isolation entirely. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable and subsequent systems in shared deployments.

Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged SecureBucket parent evidence, causing the validator to incorrectly classify unsafe bucket configurations as compliant and bypass associated security controls. The flaw (internally tracked as HULUMI-H1) exists because the validator did not correlate submitted evidence against the expected component-to-resource relationship, allowing fabricated evidence to satisfy policy checks. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.3.2.

IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.

Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fixed release (1.3.2) and a GHSA advisory are available.

Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configurations to pass automated policy inspection. The G_OIDC_1 trust-policy inspector only matched exact StringLike/StringEquals condition operators, so set-qualified operators like ForAnyValue:StringLike could smuggle wildcard GitHub Actions OIDC 'sub' conditions past the mandatory check, letting an overly permissive AWS role assumption go undetected. Reported by VulnCheck; no public exploit is identified at time of analysis, and it is not on CISA KEV. The CVSS 4.0 score is 9.3 (Critical).

Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.

TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.

Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Tenant authorization bypass in ash_phoenix's SubdomainHook allows an authenticated user to cross tenant boundaries and access or modify data belonging to other tenants. The flaw is rooted in a LiveView lifecycle ordering error: AshPhoenix.LiveView.SubdomainHook.on_mount/4 called the consumer-defined authorization callback before Phoenix LiveView's handle_params phase had run, guaranteeing the callback always received a nil tenant and either crashed or silently permitted the request. Critically, the flawed check was never re-evaluated on subsequent in-session navigations, so the bypass persisted for the lifetime of the LiveView connection. No public exploit has been identified at time of analysis, but the bypass is systematic and total for all affected deployments using SubdomainHook with tenant-scoped authorization callbacks.

Authorization bypass in AshAi (ash_ai) versions 0.6.0 through pre-1.0.0 allows any authenticated tool caller to update or destroy database records it never legitimately identified, up to and including every row in a table. The flaw is in AshAi.Tool.Execution.identity_filter/3, which passes raw tool arguments directly into Ash.Query.do_filter/2; because Ash's filter DSL interprets map values as predicate expressions rather than scalar literals, a caller can inject filter logic such as {"not_eq": "<own-ref>"} to retarget bulk writes to arbitrary records. A vendor patch is available in commit 87f616d and the fix version is 1.0.0; no public exploit or CISA KEV listing exists at time of analysis.

DNS-rebinding protection in AshAi.Mcp.Server (ash_ai 0.8.0-0.x) is bypassable because the default origin check trusts the attacker-controlled Host and X-Forwarded-Proto headers as proxies for TLS context. A malicious web page can exploit this to issue arbitrary cross-site requests to the victim's locally running MCP server, executing MCP calls under the victim's actor credentials. No public exploit has been identified at time of analysis, but the attack path is mechanically straightforward for any attacker who can lure a developer to a malicious page while they have the MCP server running locally.

Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete Smart QoS rules by sending a crafted POST request to the delSmartQosCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no access-control check, so any attacker able to reach the device's web interface can remove QoS configuration without credentials. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, so this reads as a broadly exploitable but not-yet-weaponized SOHO router flaw.

Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.

Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.

Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe system logs by sending a crafted POST request to the clearSyslog handler at /cgi-bin/cstecgi.cgi, with no credentials required. The flaw is an incorrect-access-control (CWE-284) gap on an administrative maintenance function that should be privileged. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with a niche consumer-router target rather than mass exploitation.

Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.

Root-level device takeover in the Tenda HG21 gateway (firmware V4.0.0-260302) stems from hardcoded credentials baked into the built-in Admin account, letting attackers authenticate and obtain full root access. The flaw is remotely reachable and requires no legitimate credentials since the login secret is static across devices, and a public GitHub gist writeup/exploit is available. It is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread automated exploitation yet.

Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.

Clock manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device system time by sending a crafted POST request to the NTPSyncWithHost handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so no credentials are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the assigned CVSS 9.1 appears inflated relative to the described 'change the clock' impact.

Unauthenticated firmware upload in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets remote attackers push a crafted firmware image via the UploadFirmwareFile handler in /cgi-bin/cstecgi.cgi without any credentials. Because the device applies attacker-supplied firmware, this is effectively a full-device-takeover primitive yielding persistent code execution. No public exploit is identified at time of analysis; EPSS is low (0.16%, 6th percentile) despite the 9.8 CVSS.

Improper access control in the delParentalRules handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The action requires no authentication (PR:N) and is automatable, though EPSS is low (0.18%) and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, so this is a real but not-yet-exploited network-reachable weakness.

Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.

Unauthenticated device deletion in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers remove any managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delDevice function fails to enforce access control (CWE-284), so no credentials are needed. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), indicating limited observed interest despite the high CVSS 9.1 rating.

Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Improper access control in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets unauthenticated remote attackers invoke the setWiFiWpsStart function via a crafted POST request to /cgi-bin/cstecgi.cgi, forcing the device to open a WPS wireless pairing window without any credentials. Because WPS pairing enables a nearby attacker to join the wireless network, this exposes the LAN and its traffic to unauthorized access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.

Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.

Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.