Authentication Bypass

Privilege escalation in Azure Red Hat OpenShift (ARO) lets an already-authenticated network attacker with limited rights (PR:L) bypass authorization controls (CWE-285) to gain elevated privileges with full confidentiality, integrity, and availability impact. Because the CVSS scope is changed (S:C), the compromise can extend beyond the initially authorized boundary into other components of the managed cluster or platform. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the 9.9 CVSS and SSVC 'total' technical impact make it a high-priority patch for any ARO tenant.

Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authorization bypass in Zalando Skipper (all versions through 0.27.25) lets remote unauthenticated attackers evade Open Policy Agent body-content authorization by padding a request past the configured maxBodyBytes limit. Because Skipper forwards the oversized payload upstream while handing OPA an empty parsed_body, deny-on-presence Rego policies fail open and forbidden actions execute. This is an incomplete fix for CVE-2026-50197; publicly available exploit code exists (docker-compose PoC in the GHSA advisory), but there is no public evidence of active exploitation and no code-level fix - v0.27.26 only adds documentation.

Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.

Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote unauthenticated attackers defeat identity verification and gain full control over the managed file transfer server. Because MOVEit is a high-value data-exchange gateway, a successful bypass exposes all hosted files and administrative functions. No public exploit identified at time of analysis, and EPSS probability is low (0.18%, 8th percentile) despite the 9.8 CVSS, reflecting no observed exploitation yet.

Unauthenticated arbitrary blob creation in Chatwoot before 4.16.0 lets remote attackers abuse the ActiveStorage direct-uploads controller, which lacks authentication (CWE-306), to resolve any tenant's account and conversation and obtain signed PUT URLs for writing attacker-controlled data into the shared storage backend. The flaw affects all self-hosted and multi-tenant Chatwoot deployments prior to 4.16.0, is reported by VulnCheck, and has publicly available exploit code exists (no CISA KEV listing). The CVSS 4.0 vector emphasizes integrity impact (VI:H) with a secondary availability effect (VA:L) and no confidentiality loss.

Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.

Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.

Cross-tenant privilege abuse in CyberPanel through 1.9.1 lets any authenticated panel user read, delete, or restore other tenants' incremental backups by supplying a guessed IncJob integer ID that the IncBackups handlers never re-scope to the caller's own domain. The flaw affects the deleteBackup, fetchRestorePoints, and restorePoint endpoints; because IncJob IDs are globally sequential, an attacker can trivially enumerate victims, and unauthorized restores execute with root privileges. No public exploit identified at time of analysis, but the root cause and fix are fully disclosed in vendor commit b198460.

Cross-tenant backup tampering in CyberPanel (through 1.9.1) lets an authenticated low-privileged tenant terminate, delete, and corrupt other tenants' backups via the cancelBackupCreation handler. Because the privileged worker acted purely on attacker-supplied backupCancellationDomain and fileName parameters without an ownership check, any logged-in user could send crafted POST requests to kill backup processes, remove backup archives, rewrite status files, and delete database records belonging to other tenants. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.

Authentication bypass in Logto versions 1.10.1 through 1.37.1 allows remote attackers to gain unauthorized access to accounts by using email identifiers that differ only in case or Unicode representation, due to missing normalization during principal lookup. An attacker can register or authenticate with a case-variant of a target email and collide with the intended principal, leading to account takeover without user interaction. No active exploitation or public exploit code has been identified, and EPSS indicates low exploitation probability.

Remote attackers can bypass locally configured multi-factor authentication (MFA) in Logto when users authenticate via Single Sign-On (SSO). Affecting Logto versions 1.19.0 through 1.37.1, the flaw allows an attacker with valid SSO credentials to access user accounts without providing a second factor, leading to unauthorized data access and account manipulation. No public exploit is known, and EPSS indicates low exploitation probability (0.19%).

Authentication bypass in Logto allows replay of captured OIDC id_tokens due to missing nonce claim

Account takeover in Logto due to unverified email-based SSO linking allows attackers to gain unauthorized access to victim accounts. Affected versions 1.11.0 through 1.37.1 allow an attacker to register with a permissive identity provider using a victim's email and link that identity to the victim's existing account without email verification, bypassing authentication. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability.

Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.

Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the host through a path traversal flaw in the database download feature. Because readable files can include stored authentication credentials, a single crafted request can escalate to full unauthorized access to the application. There is no public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and zero-precondition attack surface make this a high-priority patch.

Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers traverse the filesystem via the font-processing feature and retrieve any file the service account can access. Because readable files include stored authentication credentials, a successful read can be pivoted into full unauthorized access to the application. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV, but the CVSS 4.0 base score is 9.3 (Critical).

Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the server through a path traversal flaw in the SVG processing feature. Because readable files include stored authentication credentials, an attacker can pivot from file disclosure to full unauthorized access of the application. Disclosed by VulnCheck with a CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Broken access control in the Grav API Plugin before 1.0.10 lets authenticated users holding the api.config.write privilege modify security-critical configuration scopes they should not control, specifically site-wide rate limiting and CORS policy. An attacker can switch off rate limiting to enable unthrottled credential brute-forcing and add attacker-controlled origins to CORS with credentials enabled, weakening the site's authentication and cross-origin defenses. No public exploit identified at time of analysis; the issue is rated CVSS 4.0 8.2 (High) and classified as CWE-862 Missing Authorization.

Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not be able to reach during a Remote Development session, bypassing intended authorization controls (CWE-862). The high CVSS score (8.6) reflects a scope-changed confidentiality impact, meaning the exposure can extend beyond the vulnerable component to the host system serving the remote session. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity.

Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. There is no public exploit identified at time of analysis, but the ceiling severity warrants prompt patching.

Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote unauthenticated attackers reach functionality or data that should be access-restricted, due to a missing authorization check (CWE-862). Rated CVSS 7.5 with a confidentiality-only impact, the flaw was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Integrity compromise in the PayU India WordPress plugin (versions 3.8.9 and earlier) allows remote unauthenticated attackers to abuse functionality protected only by a missing authorization check. Reported by Patchstack, the flaw lets attackers reach privileged plugin actions without credentials, enabling manipulation of payment-related state or configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.

Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.

Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.

Authorization bypass in the MountDev AI MCP Connector for WordPress plugin (all versions ≤ 1.6.1) lets unauthenticated attackers mint an administrator-bound OAuth Bearer token by abusing an open Dynamic Client Registration endpoint together with an unprotected authorization endpoint, yielding full admin-equivalent control over the plugin's MCP tool surface and all exposed WordPress content, users, and options. Because the flaw is network-reachable with no privileges or user interaction (CVSS 9.8), it effectively grants site takeover. Currently there is no public exploit identified at time of analysis and the issue is not in CISA KEV, but Wordfence has published a detailed threat-intel entry.

Two-factor authentication bypass in the Security Ninja Premium WordPress plugin (all versions before 5.290) lets a remote attacker who already knows a valid account password log in without supplying the one-time code, defeating enforced 2FA for any user including administrators. One of the plugin's two 2FA code paths never validates the second factor, so the protection can be silently skipped. Publicly available exploit code exists (published by WPScan) and a vendor patch is available; EPSS is low at 0.25% (17th percentile), indicating no evidence of widespread automated exploitation despite the POC.

Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. Exposure of configuration data (potentially including AI-service API keys and SEO settings) plus silent permalink tampering can break site links and SEO ranking with no login required.

Authentication bypass in Next.js App Router built with Turbopack when using a single i18n locale allows unauthenticated attackers to circumvent middleware or proxy‑based authentication via crafted requests. The vulnerability affects Next.js versions 16.0.0 through 16.2.10, and is exploitable without any user interaction. A patch is available in version 16.2.11.

Authentication bypass in Eclipse Jetty's HTTP Digest authentication implementation allows an unauthenticated attacker who knows a target username to authenticate as any user whose password contains non-Latin-1 characters (CJK, Cyrillic, Arabic, Greek, emoji, etc.) by substituting those characters with literal '?' characters. The root defect is in DigestAuthentication.java, which uses ISO-8859-1 encoding at three points when computing H(A1), H(A2), and the final MD5 response hash - silently collapsing all code points above U+00FF to 0x3F, making collision credentials cryptographically indistinguishable from the original. A publicly available proof-of-concept demonstrates hash collision across Chinese, Korean, Cyrillic, and Greek passwords; no active exploitation has been confirmed by CISA KEV at time of analysis.

Certificate revocation bypass in the Netty netty-handler-ssl-ocsp module (versions before 4.1.136.Final, and 4.2.0.Final through 4.2.15.Final) lets an on-path attacker replay a stale, expired-but-GOOD OCSP response to make OcspServerCertificateValidator accept a certificate that has since been revoked. A missing return statement after the freshness check causes execution to fall through and still fire a VALID OcspValidationEvent even after flagging the response as out-of-date. Publicly available exploit code exists (a PoC unit test is embedded in the GHSA advisory); the issue is not listed in CISA KEV and no EPSS score was provided.

Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling unauthenticated remote attackers to view restricted or unpublished articles and modules. The vulnerability stems from improper authorization enforcement when ignore

Authentication bypass via IP spoofing in the IP Login extension for Joomla allows unauthenticated attackers to impersonate mapped accounts. The extension trusts forwarded client-IP headers without requiring a trusted proxy, enabling remote attackers to spoof the IP used for automatic login. No active exploitation has been confirmed, but the vulnerability is automatable and carries high integrity impact.

Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.

Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.

Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.

Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authorization bypass in MongoDB Server allows an authenticated user holding limited read privileges to read documents from collections they are not permitted to access, exploiting a discrepancy between how the $graphLookup aggregation stage is authorized versus how it is executed when the target collection is referenced inside an existing view's pipeline definition. The flaw (CWE-863, Incorrect Authorization) yields cross-collection data disclosure with no integrity or availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV; it was self-reported by MongoDB's CNA and tracked in SERVER-127357.

Authorization bypass in MongoDB Server allows an authenticated low-privileged user to read and write documents that should be shielded by role-based, query-level access controls. Because the server insufficiently validates certain client-supplied command parameters, crafted find, update, delete, and aggregate commands can sidestep the access boundaries enforced for a user's role. The flaw only manifests in non-apiStrict deployments (the default), and per the vendor CVSS 4.0 vector it yields high confidentiality and integrity impact; no public exploit has been identified at time of analysis.

MFA bypass in NetApp ONTAP 9.16.1 and later occurs when WebAuthn multi-factor authentication is configured, stemming from improper handling of the WebAuthn Relying Party ID. An attacker who already holds valid credentials can defeat the second authentication factor and gain full administrative access to the storage management plane. No public exploit identified at time of analysis; the flaw is vendor-reported by NetApp and not listed in CISA KEV.

Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an unvalidated teamId, enabling exfiltration of sensitive booking data including organizer/attend

Broken object-level authorization in Onlook through version 0.2.32 allows authenticated attackers to read, modify, and delete other users' projects, members, and chat conversations by passing arbitrary projectId or conversationId UUIDs to tRPC procedures such as project.get, member.remove, and chat.conversation.delete. Because the affected procedures trusted client-supplied identifiers without verifying the caller's ownership, any logged-in user could reach cross-tenant data. Publicly available exploit material exists (VulnCheck advisory and a GitHub issue), and the vendor has shipped a fix in commit 423e2e9, though there is no public exploit identified as being used in active attacks.

DNSSEC wildcard validation bypass in PowerDNS Recursor allows an attacker controlling or spoofing DNS responses to forge signed records by supplying RRSIGs whose label count is smaller than required. Because the validator fails to reject RRSIGs with too few labels, a wildcard signature can be replayed to authenticate names it should not cover, letting an attacker present forged-but-'validated' DNS data for a signed zone. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the primary consequence is integrity (data forgery), not confidentiality or denial of service.

Local privilege escalation in PortProtonQt (the Qt-based front-end for the PortProton Linux gaming launcher) before commit 0d0f0950 lets any unprivileged local user gain root-equivalent control over storage and networking. The shipped Polkit rule authorized privileged udisks2 and NetworkManager actions by inspecting the caller's process command line via `ps` for the string "ppqtos", a check any user can trivially spoof to bypass authorization. There is no public exploit code and it is not in CISA KEV, but the vulnerable rule and its trivial bypass are fully disclosed in the advisory and patch, and the vendor has released a fix (version 1.3.1).

Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.

Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.

Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.

Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.

Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.

Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unauthenticated attackers download invoice data belonging to other users because the extension fails to verify the requester's authorization. Rated CVSS 7.5 (confidentiality-only impact), with no public exploit identified at time of analysis and CISA SSVC marking exploitation status as none. The flaw is an access-control gap (CWE-284) tagged as an authentication/authorization bypass.

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affects versions 4.2.0.Final through 4.2.15.Final and all releases prior to 4.1.136.Final, where OcspClient.validateResponse never confirms that the CertificateID in an OCSP response matches the certificate being validated. An attacker holding any valid, non-revoked certificate from the same issuing CA can obtain a legitimately signed GOOD response and replay it to make Netty accept a revoked or compromised certificate as valid. Publicly available exploit code exists (a PoC test case in the GHSA advisory), but there is no public exploit identified as being used in active attacks and EPSS risk is low (0.30%, 22nd percentile).

Unauthenticated information disclosure in Feedbin (self-hosted RSS reader, commit 739884a) lets remote attackers read any user's private article content via GET /api/v2/entries/:id/text, which explicitly skipped the authorization filter. Because entry IDs are sequential integers, an attacker can enumerate and harvest plain-text bodies of private newsletters, page-saves, and articles from every user's private subscriptions across the instance. No public exploit identified at time of analysis, though a technical write-up describing the flaw exists; the CVSS 4.0 base score is 8.7 (High) driven purely by confidentiality impact.

Local privilege escalation to full takeover in the Install component of Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK (17.0.19, 21.0.11), and Oracle GraalVM Enterprise Edition (21.3.18) lets a low-privileged local user compromise the runtime and take it over with full confidentiality, integrity, and availability loss. Oracle rates it 7.8 (High) and describes it as easily exploitable by an attacker holding only a logon to the host. No public exploit has been identified at time of analysis and it is not on CISA KEV.

Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.

Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.

Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.

Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.

Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.

Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.

Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.

Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.

Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).

Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.

Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.

Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.

Data compromise in Oracle Installed Base (Create Item Instance component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all data accessible to the Installed Base module. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided in the source data.

Authenticated data compromise in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite 12.2.14–12.2.15) lets a low-privileged user with logon access to the hosting infrastructure read, create, delete, or modify all data the HR application can reach. Oracle rates it CVSS 3.1 7.1 with High confidentiality and integrity impact and no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Data compromise in the Oracle Human Resources module of Oracle E-Business Suite 12.2.14 through 12.2.15 (Enterprise Command Center component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all HR-accessible data. Oracle rates this 8.1 and describes it as easily exploitable, requiring only network access and a low-privilege account; there is no public exploit identified at time of analysis and it is not in CISA KEV. The high confidentiality and integrity impact with no availability impact makes this a strong patch priority for organizations running affected EBS releases.

Full compromise of the Oracle Human Resources module (Data Removal Tool component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, resulting in complete takeover of the Human Resources application with confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.2), the flaw requires existing elevated privileges (PR:H) but no user interaction and has low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.

Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged, network-adjacent attacker over HTTP to read, create, delete, or modify all Order Management-accessible data. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect, this flaw is described by Oracle as easily exploitable and is fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.

Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.

Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Data tampering and information disclosure in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access create, delete, or modify critical Price Protection data and read a subset of accessible data. The flaw carries a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided.

Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Data compromise in Oracle Price Protection (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, modify, or delete all data accessible to the Price Protection module. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication bypass; no public exploit identified at time of analysis.