Authentication Bypass

Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. Only network-reachable FreeRDP server-mode deployments with RDSTLS administratively disabled are affected, while client-side FreeRDP deployments are not impacted.

Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.

Cross-tenant authorization bypass in Flowise Enterprise endpoints (all versions before 3.1.4) allows an authenticated Enterprise user to operate on resources owned by other organizations — deleting arbitrary workspaces, inviting themselves into other tenants, modifying cross-organization roles, and reading or abusing stored SSO secrets. The root cause is CWE-862 (missing authorization): affected endpoints act on caller-supplied resource identifiers without verifying tenant ownership. Rated CVSS 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L), reachable over the network but requiring low-privileged Enterprise access; a vendor patch is available in 3.1.4, and no public exploit has been identified at time of analysis.

Session fixation in Dell SmartFabric OS10 Software versions prior to 10.6.1.3 allows remote, unauthenticated attackers to plant or predict a management session identifier and subsequently hijack that session once a legitimate administrator logs in, resulting in session theft with the full privileges of the compromised account. Dell's published CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that score overstates the issue on two counts: successful exploitation hinges on a victim authenticating into the attacker-controlled session (effectively a user-interaction requirement, UI:R), and the real-world impact is bounded by the privileges of the hijacked account, making confidentiality and integrity exposure meaningful but not unconditional. There is no public exploit identified at time of analysis - CISA SSVC records no observed exploitation and no proof-of-concept code is referenced - and the attacker can only realize impact through a victim-logon step, so the practical risk is lower than the raw 9.8 suggests while still warranting prompt patching of internet- or management-plane-reachable deployments.

An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.

Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.

Cross-organization user administration takeover in Casdoor through 4.4.0 allows any holder of a single application's clientId and clientSecret to act on user accounts across all organizations. The flaw is an authorization bypass in the /api/mcp endpoint that exposes password salts, email addresses, and account creation/modification/deletion capabilities. Public exploit documentation exists, but no active exploitation status or EPSS data was provided.

Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access whitelist pattern (/*/anno/**) that exposes the /defGenProject/anno/getProperties endpoint. Any remote attacker who can reach the service via HTTP can POST to that path and receive the server's complete JVM system property map, leaking classpath entries, filesystem paths, OS build details, and startup secrets injected as properties. Exploit code is publicly available (a writeup and proof-of-concept are linked from the CVE references and VulnCheck advisory), and the flaw has not been listed in CISA KEV, so it is a high-value reconnaissance and credential-harvesting primitive rather than a confirmed mass-exploitation event.

Unauthenticated credential takeover in pig-mesh Pig before 4.1.0 allows any remote attacker who can reach the /register/password endpoint to overwrite the password of an arbitrary account, including the built-in 'admin' account, and thereby obtain full administrative control of the platform. The flaw is an authentication bypass: the endpoint's password-reset logic calls checkPassword() but discards the boolean result, so the submitted 'current password' is never actually validated. Publicly available exploit code exists (a proof-of-concept write-up and the upstream issue are linked), and the vendor has released version 4.1.0 as the fix; there is no indication of confirmed exploitation in CISA KEV at the time of analysis, but the combination of unauthenticated remote exploitation, high impact (CVSS 4.0 base 9.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and public exploit code makes rapid patching warranted.

Semaphore UI through 2.19.12 fails to enforce project-level resource permissions on GET and HEAD requests in its GetMustCanMiddleware, letting any authenticated user holding only the low-privileged guest or task_runner role read every project's environment records. Those environment records store plaintext secrets, credentials, and passwords used to reach managed infrastructure, so a read-only account can effectively harvest the keys to the entire estate. Publicly available exploit code exists (tracked by VulnCheck, issue #4150), the flaw is rated 7.1 with a network attack vector and low privileges required, and no CISA KEV listing has been observed at time of analysis.

Missing authorization on pgweb's POST /api/connect endpoint through version 0.17.0 lets attackers bypass the connect-backend resource-to-database mapping by submitting a custom session identifier and arbitrary connection URL, granting access to databases and internal services the operator never intended to expose. The flaw is CWE-862 (missing authorization) and carries a CVSS 4.0 base score of 8.4 (AV:N/AC:L/PR:L/UI:N, high confidentiality impact on both the vulnerable system and subsequent systems), reflecting that a successful attacker can read arbitrary backend data while the pgweb host is used as a pivot. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently assessed as opportunistic rather than confirmed active.

Authentication bypass in praisonai-platform before 0.1.6 lets any remote unauthenticated attacker mint a valid HS256 JSON Web Token and impersonate arbitrary users against protected API routes. The flaw is a hardcoded fallback signing secret ('dev-secret-change-me') combined with a production guard that never fires when the operator leaves both PLATFORM_JWT_SECRET and PLATFORM_ENV unset - the common mis-deploy - so the platform silently starts signing tokens with a publicly known literal drawn straight from the source code. CVSS 3.1 scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and EPSS is 0.51% (42nd percentile); there is no CISA KEV listing and no public exploit identified at time of analysis, though exploitation requires nothing more than a forged token and no authentication whatsoever.

Unauthenticated authentication bypass in praisonai-platform prior to 0.1.6 (and PraisonAI before 4.6.51) allows a remote attacker to forge HS256 session JWTs using the publicly known default signing key 'dev-secret-change-me' and be accepted as any identity the attacker names in the token's sub claim, including a workspace owner. The vulnerable state is the shipped default: the documented startup command sets neither PLATFORM_JWT_SECRET (so the hardcoded fallback is used) nor PLATFORM_ENV (which stays at 'dev', leaving the startup and token-issuance guards default-open). CVSS 3.1 scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), consistent with an unauthenticated full-compromise primitive; EPSS is low at 0.53% (43rd percentile), no public exploit code was identified at time of analysis, and there is no CISA KEV listing, although the flaw is trivially exploitable against default deployments and the only practical constraint is that workspace-owner takeover requires knowing the target owner's user/sub identifier.

Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1) allows any remote caller who can reach the service to read configured agent names, roles and the first 100 characters of each agent's instructions via GET /api/agents, and to invoke a chosen agent through POST /api/chat, potentially reaching that agent's tools, memory, external APIs, credentials and workflow state. The default configuration binds to 0.0.0.0 with corsOrigins set to ['*'] and registers both routes without any authentication or authorization middleware (CWE-306), so the missing-authentication weakness applies unauthenticated over the network (CVSS 3.1 PR:N); version 1.7.2 is the vendor-released fix. No public exploit code has been identified at time of analysis, EPSS is low at 0.56% (45th percentile) and the issue is not in CISA KEV, but CISA SSVC rates it automatable with total technical impact and the exposure depends entirely on whether an operator has left AgentOS reachable on a routable interface.

PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC transport that performs no authentication or authorization, so any network client that can reach the listening port can call tools/call, resources/read, or prompts/get and trigger registered handlers with the server process's credentials and privileges. The server's startHttp() binds the unspecified address (all interfaces) with no host restriction and ignores the Authorization header entirely; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms this is unauthenticated and remotely reachable, though exploitation requires the operator to have enabled the HTTP transport and made the port network-reachable. Publicly available exploit code exists (a public gist), but there is no evidence of confirmed active exploitation, and the EPSS score is low at 0.64% (49th percentile); the vendor-released fix is version 1.7.2.

Let me synthesize. Key facts: - CVE-2026-57134, PraisonAI (npm package "praisonai", TypeScript MCP security helper). - MCPSecurity.evaluatePolicy() only validates credentials for api-key/bearer; basic/oauth accept any non-empty Authorization header, skipping validate() callback, returning authenticated: true. - Affected: npm praisonai >= 1.5.1, <= 1.7.1; fixed in 1.7.2. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* - CVSS 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. But logically, exploitation requires the deployment to use basic or oauth auth policy — that's a configuration prerequisite. Hmm. CVSS PR:N given. My assessed vector: I'd argue PR:N is defensible from the attacker's perspective (attacker sends an arbitrary Authorization header without valid credentials). But the configuration requirement: the target must use basic/oauth policy. AV:N is fine. AC:L? Arguably AC:H because it requires non-default config (basic/oauth policy configured). Let me think: the guidance says choose PR honestly — if exploitation requires control over configuration files, admin access, or authentication, use PR:H or PR:L. Here the attacker doesn't need config access; they need the target to have configured basic or oauth. That's a configuration precondition, not attacker privilege. I'd keep PR:N and use AC:H? Hmm. Many would keep AC:L. Actually the exploit is trivially automatable once the target uses basic/oauth. I'll go AC:L, PR:N, but note the pre-condition. Hmm, but the rubric's example: "Requires write access to the httpd configuration, so PR:H and AC:H". That's different. Here attacker just sends header. I'll use AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — matching but I should express independent judgment. Maybe I could argue I:L and A:N as given. Let me consider C:H — access to MCP tools and resources protected by policies → confidentiality high, integrity low. That's reasonable. I'll go with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — but then it's a copy. The instruction says "NOT

Unauthenticated MCP tool invocation in PraisonAI (praisonaiagents 0.6.0–1.6.58 and praisonai 3.10.0–4.6.58) lets a malicious website use DNS rebinding to reach a local or internal ToolsMCPServer SSE endpoint on /sse and /messages/, enumerate registered tools, and invoke them with the server user's privileges. The legacy SSE wrapper performs no Host, Origin, or authentication enforcement, while the newer Streamable HTTP transport rejects the same hostile Origin with HTTP 403, isolating the flaw to the legacy SSE path. An initial remediation ships in praisonaiagents

MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.

An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.

Incorrect authorization validation in Octopus Server permits authenticated users holding certain scoped permission sets to execute arbitrary scripts on deployment workers, including the built-in worker that runs directly within the Octopus Server process. The flaw bypasses the permission check that should gate script execution, allowing a user to operate outside their authorized scope without possessing the required authorisation. No public exploit has been identified and the CVE is not in CISA KEV, but the low authentication barrier - any user with some scoped permissions - makes this a meaningful privilege-escalation risk in CI/CD environments where Octopus Server routinely holds deployment credentials and infrastructure access.

Trust-boundary spoofing in the proxy-addr Node.js module (versions 1.1.0 through 2.0.7), the library that backs Express req.ip and req.ips, lets unauthenticated clients forge their apparent source address. When an operator declares a trusted-proxy subnet in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 rather than the correct /104), proxy-addr silently accepts it but trusts every IPv4 address on the internet, so the direct socket peer becomes trusted at hop 0 and any client can set an arbitrary X-Forwarded-For header. This is a fail-open regression introduced in 1.1.0, fixed in 2.0.8; no public exploit identified at time of analysis, and it is not in CISA KEV.

Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Authorization bypass in IceHRM before 36.0.0 lets any authenticated employee read coworkers' HR records by substituting an arbitrary employee ID in seven REST sub-resource endpoints covering skills, education, certifications, languages, leave, attendance and status. CVSS 4.0 scores the flaw 7.1 (AV:N/AC:L/PR:L/UI:N, VC:H only), reflecting a low-effort, easily automated disclosure of sensitive personnel data rather than code execution. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in release v36.0.0.

Scheduled-job management functionality in 1024-lab SmartAdmin v3.30.0 is exposed without method-level permission checks, so any user who already holds a valid low-privileged account can reach administrator-only endpoints in AdminSmartJobController. Successful exploitation yields high confidentiality and integrity impact — job definitions and their parameters can be read, created, modified, or deleted — while availability is not directly affected per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so current risk is driven by exposure of the application to authenticated non-admin users rather than by observed mass exploitation.

Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.

Unauthenticated retrieval of Stripe Checkout Session objects in the MarcosCamara01 Ecommerce Template (before commit 91e273c) exposes buyer personally identifiable information to anyone holding a session id. The GET handler at /api/stripe/checkout_sessions calls stripe.checkout.sessions.retrieve() and returns the full object — buyer name, email, phone, billing address, amount paid and internal userId — without ever calling auth.api.getSession() or verifying that the session belongs to the caller, even though sibling endpoints such as POST /api/stripe/payment already enforced authentication. Exploitation is not confirmed in the wild and no public exploit code was identified, but the session_id is written into the buyer's own success_url (/result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics, access logs and shared-machine browser history, making the flaw practically reachable rather than purely theoretical.

Improper access control in IBM Sterling File Gateway (6.2.0.0 through 6.2.0.6_1, 6.2.1.0-6.2.1.2, and 6.2.2.0-6.2.2.1) lets a remote, unauthenticated attacker reach file-transfer data they should not be able to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) describes a trivially reachable, no-credentials-required read of sensitive information with no integrity or availability impact. No public exploit code or CISA KEV entry was present in the supplied intelligence at the time of analysis, and IBM has published a vendor fix.

Sandbox escape in Apple macOS lets a malicious or compromised application already running inside the macOS App Sandbox break out of that confinement and operate with privileges beyond what its sandbox profile permits (CVSS 3.1 base 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Affected systems are macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27; exploitation requires the attacker to already have local code execution as a sandboxed app (for example, one the user installed and launched), and provides no remote initial access, functioning as a boundary-crossing primitive once code is running on the host. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.19% (9th percentile), so real-world activity appears limited, though the sandbox-boundary impact keeps this a serious local isolation flaw rather than a theoretical one.

Improper handling of persistent identifiers in Apple's mobile and desktop operating systems allows an app installed on the device to recognize the same user across app reinstalls, defeating the identifier-reset behavior that users and administrators rely on for privacy. Apple states the issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the affected CPE set covers all earlier releases of iOS/iPadOS, macOS, and visionOS. No public exploit code or CISA KEV entry has been reported at time of analysis, and EPSS is only 0.16% (6th percentile), so this is a privacy-integrity hardening fix rather than an emergency remote-code-execution patch.

A local sandbox-escape flaw in Apple macOS (CWE-284, improper access control via faulty state management) allows a malicious application to break out of its App Sandbox and operate outside the restricted environment it was granted. Affected versions are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, with Apple shipping fixes in all three (support.apple.com advisories 149035, 149042, 149043). CVSS 3.1 rates it 8.2 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis — so this is a high-severity, low-current-activity issue whose priority is driven by the App Sandbox being a core macOS security boundary rather than by observed exploitation.

Local privilege escalation in Apple macOS lets an application running with standard user privileges obtain root, giving an attacker full control of the host once code executes on the machine. The flaw is an improper access-control check (CWE-284) that Apple addressed with improved validation logic, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. No public exploit code has been identified and the vulnerability is not in CISA KEV; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so risk is concentrated in environments where untrusted local code can be executed.

Apple macOS contains a local privilege-escalation flaw in which an application running under an ordinary user account can abuse insufficient access-control checks to obtain root privileges. Devices are affected if they run macOS versions below Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, and Apple has shipped fixes for all three release lines. CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CISA's SSVC rates technical impact as total, but there is no CISA KEV listing, no reported exploitation and no public exploit code identified at time of analysis, so this is best treated as a high-value post-compromise escalation primitive rather than an imminent remote threat.

Missing entitlement checks in Apple's iOS and iPadOS, tvOS, watchOS, and visionOS (all versions before the 27 release train) allow a locally installed app to read device attributes it is not authorized to access and combine them into a persistent fingerprint of the user. Only devices running an affected platform with an attacker-supplied app already installed are exposed; the independent assessment re-scores the issue as local-access with confidentiality-only impact (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), which is materially lower than the supplied CVSS 3.1 vector (AV:N, 7.5) that treats the flaw as remotely reachable. There is no indication of active exploitation, KEV status is not set, and no public exploit code has been identified at time of analysis; EPSS is 0.19% (9th percentile), consistent with a low near-term exploit probability. Apple has released fixes in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.

A local privilege-escalation flaw in Apple's operating system family lets a malicious app already running on the device obtain root privileges by exploiting a missing authorization check. Apple addressed the issue with 'additional restrictions' in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not confirmed: the issue is not in CISA KEV, no public exploit code is identified, and CISA's SSVC assessment lists exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' once root is achieved.

Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.

Authentication bypass in ESPHome Device Builder (the esphome-device-builder package powering the `dashboard` subcommand of the ghcr.io/esphome/esphome container) versions before 1.0.12 silently disables dashboard authentication on upgrade for operators who had protected it with the legacy bare $USERNAME/$PASSWORD environment variables. A rename to $ESPHOME_USERNAME/$ESPHOME_PASSWORD (PR #265) dropped the old names with no fallback, so `using_password` becomes false and both the REST auth middleware and WebSocket login gate switch off, leaving the dashboard open to anyone who can reach its port. Because a compromised dashboard caller can compile arbitrary code and read/write config and data directories, this is effectively unauthenticated RCE; publicly available exploit/PoC code exists, though it is not in CISA KEV (SSVC exploitation: none).

Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RFC 2822 messages to /admin/mail/inbound-parse and plant arbitrary emails — including forged replies stitched into existing conversation threads — in victim CRM inboxes on every release through 2.2.6. VulnCheck reports proof-of-concept exploit code (SSVC Exploitation: PoC) and the attack is fully automatable, but the issue is not listed in CISA KEV, so active in-the-wild abuse is not confirmed; the CVSS v4.0 base score is 8.8, driven by high integrity impact with no confidentiality impact and only limited availability impact.

Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and /api/get-cert endpoints, letting an authenticated organization administrator retrieve a key that should never leave the server. Because a single shared key signs tokens for the entire deployment, any one org admin can forge valid JWTs for arbitrary users in any organization - including global administrators - turning a tenant-scoped role into a full cross-tenant authentication bypass (CWE-863, improper authorization). Publicly available exploit code exists (a detailed write-up for finding 3 is linked, described as an incomplete fix of issue #3003), and VulnCheck rates the technical impact as total; EPSS is low at 0.21% (11th percentile), and the flaw is not confirmed as actively exploited. Exploitation requires a prior authenticated org-admin account and is not reachable anonymously.

A local unprivileged user can hijack the Control Interface of another workload in Eclipse Ankaios 0.1.0 through 1.0.2 by pre-creating the agent's predictable run-folder path hierarchy and Control Interface FIFOs under the shared default location `$TMPDIR/ankaios`. Because the agent reuses an existing directory or FIFO based only on an existence/file-type check — without verifying ownership or permissions — it treats the attacker-owned pipes as the legitimate Control Interface and executes requests under that workload's configured `controlInterfaceAccess` permissions, enabling workload impersonation and unauthorized reading or modification of the cluster's desired state. The flaw is CWE-379 (insecure temporary file/permissions), carries a CVSS 4.0 base score of 8.4 (AV:L/PR:L/AT:P, high confidentiality and integrity impact), and has no public exploit code or CISA KEV listing at time of analysis; EPSS is 0.09%, consistent with a local, non-automatable attack. The vendor released v1.0.3 with an ownership/permission validation check (PR #799).

Missing authorization in DotVVM's AuthorizeActionFilter causes any ASP.NET web application that relies on that filter to grant unauthenticated remote access to protected commands, view models, and presenters - the filter performs no check at all, so no bypass technique is required. All DotVVM releases before 4.2.11, the 4.3.0-preview01 through 4.3.15 range, and 5.0.0-preview01 through 5.0.0-preview09-final are affected; the vendor rates this critical (CVSS 4.0 base 9.2, independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity, and availability impact). Exploitation applies only where AuthorizeActionFilter is actually wired up (CVSS 4.0 AT:P expresses that attack requirement), and no public exploit code and no confirmed active exploitation were identified at time of analysis, with EPSS at just 0.44% (37th percentile).

HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.

Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. The vendor advisory includes working reproduction steps, and SSVC records that proof-of-concept exploitation is available and automatable, though no CISA KEV listing or EPSS score was supplied.

Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. Affected builds span the EUVD-listed 12.8.1-002 through 16.0.4-010 trains; no public exploit has been identified at time of analysis, EPSS is 0.46% (39th percentile), and CISA SSVC records exploitation as none.

PraisonAI deployments that opt out of authentication by setting PRAISONAI_CALL_AUTH=disabled expose the /api/v1/

Authentication bypass in PraisonAI's `recipe serve` command: when an operator selects `auth: api-key` or `auth: jwt` in a recipe YAML but omits the matching `api_key:`/`jwt_secret:` value and does not export PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET, APIKeyAuthMiddleware and JWTAuthMiddleware take a fail-open branch and forward every non-`/health` request unauthenticated to the recipe execution, input, and output surfaces, potentially triggering connected tools. Remote unauthenticated attackers who can reach an exposed recipe-serve endpoint (CVSS:3.1/AV:N/PR:N/UI:N) can therefore act as if authenticated, though independent analysis raises attack complexity to AC:H because the rawe 9.8 vendor score only manifests under a specific operator mis-deployment - the fail-open does not occur when the secret is set or when authentication was never enabled. Publicly available exploit code exists per the SSVC exploitation signal (poc), EPSS is 0.90% (58th percentile), and the issue is not listed in CISA KEV; it is fixed in 4.6.58.

Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59, where the MCP SSE transport started by ToolsMCPServer.run_sse() or launch_tools_mcp_server(transport='sse') binds to 0.0.0.0 and builds its Starlette application with no authentication middleware and no Origin validation. Any client that can reach the listening port (default 8080) can list and invoke every registered tool without credentials, and because the bundled SecurityConfig, origin-validation and DNS-rebinding checks in mcp/mcp_security.py are never called, a malicious web page can rebind a hostname to 127.0.0.1 and drive the same JSON-RPC calls against a developer's local instance; the practical impact scales with the registered toolset and becomes full RCE where file, shell, or code-execution tools are exposed. Exposure is gated on an operator actually launching the SSE transport - merely importing the library is not sufficient - and no public exploit code has been identified at time of analysis (EPSS 0.47%, SSVC exploitation: none), with a vendor patch available in 1.6.59.

Improper input validation in Zscaler Client Connector for Android and ChromeOS (builds prior to 4.2.0.152) lets an attacker with elevated local privileges on the endpoint feed malformed input to the connector and bypass Zscaler's traffic inspection and access controls, with a CVSS 8.1 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) rating that reflects total loss of the security control's integrity. The flaw is not remotely exploitable and requires high privileges (root or equivalent device-admin context) on the affected Android or ChromeOS device, and there is no public exploit identified at time of analysis. EPSS is 0.12% (2nd percentile) and CISA SSVC records exploitation 'none', automatable 'no' with total technical impact — a low-likelihood, patch-promptly issue rather than an emergency.

Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbitrary operating-system commands on servers exposing the Jobs API. The attack chains two defects: the POST /api/v1/runs endpoint ships without the verify_token dependency used by the authenticated agent_invoke endpoint (PR:N, no credentials or session required), and an attacker-supplied top-level 'approve' field in the submitted agent_yaml is loaded into a ContextVar that the @require_approval decorator consults before any risk-level check, so listing 'execute_command' makes the critical-tool approval gate a no-op with no operator interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-306). Affected releases are praisonai through 4.6.48 and praisonaiagents prior to 1.6.59, both fixed in 4.6.59 and 1.6.59 respectively; publicly available exploit code exists (a curl-based PoC is published in the GHSA advisory) and CISA's SSVC assessment rates the issue automatable with total technical impact, although no confirmed active exploitation (CISA KEV) has been reported and the current EPSS score is low at 0.41% (35th percentile).

SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with the attack not automatable.

Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.

LangBot's debug WebSocket server binds to all interfaces on port 5401 and ships with an empty authentication key by default - and the official Docker image together with its docker-compose configuration publish that port to the host, placing every default deployment within reach of any network attacker. A remote unauthenticated attacker who reaches the /plugin/ws endpoint can register an arbitrary debug plugin, after which LangBot broadcasts the full plaintext context of every inbound IM message event to that plugin, enabling mass interception of private chats, forged bot replies, LLM pipeline poisoning via malicious tool registration, knowledge-base enumeration, and persistent denial of service by blocking legitimate plugin installations with the prod_mode flag. No patched version was available at time of publication; SSVC classifies exploitation as proof-of-concept-available and fully automatable.

Symlink path traversal in File Browser ≤2.63.23 lets authenticated low-privilege users bypass configured deny rules to read and overwrite restricted files. The access-control engine evaluates rules against the lexically requested path but does not re-apply those rules after resolving symbolic links to their targets, creating a security boundary gap that is exploitable wherever an attacker can access an in-scope symlink pointing outside their permitted tree. A proof-of-concept exists per SSVC analysis; no public exploit code has been confirmed in CISA KEV at time of analysis.

Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated principal that holds a search entitlement to retrieve identity and entity records outside its authorized realms by issuing a non-recursive search request. The Realms filter that normally constrains results to the requester's permissions can be rendered empty for non-recursive queries, effectively removing the privilege restriction before the search is translated into SQL, Neo4j, or Elasticsearch/OpenSearch queries; recursive searches are not affected. The exposure is backend-agnostic but gated by authentication and an existing search entitlement, so it is a data-confidentiality bypass rather than anonymous remote code execution - no public exploit code has been identified at time of analysis, EPSS is low (0.48%, ~40th percentile), and there is no CISA KEV listing. Vendor fixes are available in 4.0.8 and 4.1.3.

Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administrator invoke pull and push operations without holding the required entitlements, because the entitlement checks on those endpoints are incomplete. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. There is no public exploit identified at time of analysis and SSVC records exploitation status as none, though CISA's framework rates the technical impact as total and the weakness as automatable.

Sensitive information disclosure in Hiperdino's REST v1.0 API lets a caller holding a valid static bearer token query the public 'customer/check' endpoint with a phone number or email and confirm whether it belongs to a registered customer, returning that customer's email and telephone. The endpoint enforces no per-user authentication beyond a shared static token, applies no rate limiting, and returns distinguishable responses, enabling bulk enumeration of contact details. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.

JWT privilege-spoofing in Apache Syncope allows an authenticated attacker to impersonate any other user if the internal JWKS configuration (at minimum the signing protocol and key) has been disclosed. The attacker must first complete a legitimate authentication and obtain a valid JWT, then leverage the disclosed JWKS material to forge tokens carrying another user's identity claims. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the impact is complete horizontal and vertical privilege escalation within the identity governance platform.

Unauthenticated remote code execution in Maxim AI's Bifrost LLM gateway (transports v2.0.0 and earlier) allows any network caller to run arbitrary programs as the gateway process user. Bifrost's management API registers MCP stdio clients as a raw command-plus-args pair and launches that program immediately upon registration with no MCP handshake, and because governance.auth_config.is_enabled defaults to false, a single POST /api/mcp/client requires no credentials. A vendor patch exists (transports/v2.1.0), which refuses unauthenticated stdio registration with HTTP 403; no public exploit is identified at time of analysis, though the attack is trivially scriptable.

Apache Doris contains an incorrect authorization flaw (CWE-863) that lets an authenticated user bypass privilege checks and reach data or operations they should not be permitted to touch. Affected branches are 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3; the CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact places this in the critical severity band. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the vendor describes the technical impact as total and CVSS 8.8 reflects broad read/write exposure within the cluster.

Missing authentication on a critical function in the Contec CPSL-08P1EN allows a network-reachable attacker to operate the device without supplying credentials. The flaw (CWE-306) means a protected management or control function is reachable directly over the network with no authentication gate, giving an adversary the same effective access as a legitimate administrator. No public exploit or CISA KEV listing exists at time of analysis, but the straightforward exploitation path (no complexity, no user interaction) lowers the bar for opportunistic targeting of Internet-exposed or weakly-segmented devices.

Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.

Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.

The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.

Authenticated Storm operator sessions are exposed to arbitrary web origin reads via three independent misconfigurations in Apache Storm Webapp 3.0.0: Logviewer CORS origin reflection combined with credentialed responses, a CORS filter initialization parameter mismatch that causes containers to silently apply permissive defaults, and unrestricted JSONP callback wrapping on all GET endpoints that bypasses the Same-Origin Policy entirely. Any malicious web page visited by an authenticated operator can silently exfiltrate cluster topology, configuration, and worker log data on the operator's behalf without requiring any additional privileges. No public exploit has been identified at time of analysis; vendor-released patch version 3.1.0 is available.

Rebalance operations in Apache Storm Nimbus 3.0.0 allow an authenticated attacker with topology rebalance rights to inject unauthorized blobstore map entries into configuration overrides, causing Supervisor nodes to fetch and locally cache blobs whose ACLs do not grant the caller access. A companion authorization-bypass in the listBlobs operation exposes the full blobstore key namespace to any caller reaching the Nimbus Thrift port without any subject check, supplying the key names that make the rebalance bypass actionable. No public exploit is identified at time of analysis; the vendor-confirmed fix is version 3.1.0 of org.apache.storm:storm-server.

Authorization bypass in Apache Storm Client 3.0.0 permits any authenticated Nimbus principal to perform unrestricted user-level cluster operations when access control is configured via `nimbus.groups` alone. The `SimpleACLAuthorizer` evaluates user-level commands by returning early with a grant when `nimbus.users` is empty, never reaching the group evaluation branch, so group restrictions are silently ignored. Operators who followed the documented `nimbus.groups`-only access control pattern in `docs/SECURITY.md` would believe their cluster was restricted while every authenticated credential held full permission to submit topologies, upload files, and retrieve Nimbus configuration. No public exploit code exists and no CISA KEV listing is present at time of analysis.

SSH key injection in Froxlor before 2.3.12 allows authenticated customers to write arbitrary lines into server-side authorized_keys files by embedding newline characters in SSH public key submissions to the SshKeys::add() API endpoint. An attacker with a valid customer account can plant SSH key entries bearing OpenSSH option directives (e.g., command=, from=, restrict) that persist beyond explicit key-deletion and access-revocation actions performed by administrators. No public exploit has been identified at time of analysis, but the vendor advisory confirms the flaw and the fix version.

Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.

Man-in-the-middle interception of protected ICS communications affects the ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 on Windows, whose IEC 60870-5-104 TLS client (Task Mode) improperly validates server certificates. A network-positioned attacker can present a certificate containing multiple simultaneous defects that the client accepts, defeating TLS authentication and exposing/altering traffic between the test set and a downstream RTU/IED. No public exploit code or CISA KEV listing is identified at time of analysis, and no EPSS score was provided; risk is elevated by the ICS/OT context rather than by evidence of active exploitation.

MCPHub's embedded OAuth 2.0 authorization server before v1.0.32 allows an attacker who intercepts a victim's authorization code to redeem it for valid access tokens without supplying a client secret or PKCE verifier. The root cause is a logic inversion in client authentication: the pre-fix condition checked `if (clientSecret && client.clientSecret)`, meaning that omitting the secret in a token request caused the entire secret-validation block to be skipped, even for confidential clients with a registered secret. Simultaneously, PKCE enforcement was absent for public clients, leaving no proof-of-possession check between code issuance and token exchange. Vendor-released patch v1.0.32 is available; no public exploit or CISA KEV listing has been identified at time of analysis.

Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.

Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.

Privilege escalation in an ICS API routing component (ICSA-26-254-01) allows a low-privileged authenticated attacker to bypass role-based authorization by manipulating a client-controlled HTTP header that governs authentication-path selection. The routing layer directs requests to one of two authentication backends based on a header the attacker fully controls; by setting that header to invoke the alternate path, the attacker assumes a fixed, elevated role and can perform actions restricted to higher-privileged users. No public exploit is identified at time of analysis; the advisory originates from ICS-CERT, indicating deployment in operational technology environments where unauthorized privileged write access carries operational consequence beyond what CVSS scores alone convey.

Prototype pollution in the yayson npm JSON:API library (<= 4.2.0) lets a remote attacker corrupt Object.prototype by submitting a document whose resource type is "__proto__". Store/LegacyStore use the attacker-supplied type, id, and relationship names as plain-object keys in internal lookup tables, so a crafted JSON:API payload writes attacker-controlled key/value pairs onto every object in the Node.js process for its lifetime. Proof-of-concept code is published in the GitHub Security Advisory; there is no evidence of active exploitation. The guaranteed impact is process-wide denial of service and logic corruption, with escalation to authorization bypass or RCE dependent on gadgets in the consuming application.

Unauthenticated arbitrary SQL execution in the mysql-mcp-server (designcomputer) MCP server occurs when it runs in SSE/HTTP transport mode (MCP_TRANSPORT=sse), where SseServerTransport is created without security_settings, disabling the MCP Python SDK's DNS-rebinding (Origin/Host) validation, omitting CORS/TrustedHost middleware, and binding to 0.0.0.0 with no authentication on any route. Any network-reachable attacker can invoke the execute_sql tool to dump or modify the entire database, and where the MySQL account holds FILE privilege, achieve arbitrary file read/write and potential RCE via webshell drop. The vendor reports 25 publicly reachable SSE instances found via internet-wide scanning; no CISA KEV listing and no standalone published exploit, so this is best characterized as no public exploit identified at time of analysis despite detailed attack scenarios in the advisory.

Unauthenticated administrator account creation affects GetSimple CMS (v3.4.0a and earlier) and its community edition GetSimpleCMS-CE (v3.3.22 and earlier), where a self-exclusion bug in the post-installation cleanup logic leaves admin/setup.php reachable on production sites. Any remote attacker can invoke the still-present setup script to register a new administrator, yielding full control of the CMS. No patched version exists at publication and no public exploit has been identified, though the flaw is trivially reproducible from the advisory description.

Missing origin validation in wpa_supplicant's driver-based PMKSA cache selection path allows a local low-privileged attacker to bypass network context and AKMP matching, forcing the supplicant to use a cached Pairwise Master Key Security Association from a mismatched network or authentication method. All wpa_supplicant versions prior to 2.12 are affected. Successful exploitation can allow the attacker to bypass Wi-Fi authentication controls, potentially enabling connection to unintended network segments or interception of traffic through credential reuse across network boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis.

Full account takeover in SPIP before 4.4.18 lets unauthenticated attackers reset the password of any user - including administrators - by invoking the editer_auteur administrative action directly over HTTP. The administrative action endpoints under ecrire/action/ accept a valid HMAC-SHA256 nonce as sufficient proof of authorization but never call autoriser() to verify server-side permissions, so an anonymous user can compute a valid nonce for any action. Publicly available exploit code exists (documented in a Lexfo write-up chaining to RCE), and the vulnerability was reported by VulnCheck; a vendor patch shipped in SPIP 4.4.18.

Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.

Hard-coded bootloader credentials in the ANJIA AJL33PC0801 IP camera allow any attacker with physical device access to authenticate to the bootloader without knowing a legitimate password. Successful exploitation grants full control over firmware loading and system configuration, enabling persistent device compromise, implant installation, or complete operational disruption. CISA issued ICS advisory ICSA-26-251-01 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.

Cross-origin WebSocket hijacking in Headroom's proxy layer (prior to v0.35.0) allows an unauthenticated attacker-controlled webpage to issue arbitrary LLM requests through the victim's Headroom instance without authentication. Because the WebSocket server forwards requests to the upstream LLM provider without validating the Origin header, any browser with network access to the proxy-standard or headless-can be weaponized as a relay. The primary concrete impact is unauthorized consumption of the stored OpenAI API key and potential exposure of LLM response content; no public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis.

Unauthenticated file read in WWBN AVideo's getRecordedFile.php endpoint exposes recorded live-stream FLV files to any network attacker without authentication or authorization. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. An attacker who can reach the web interface and supply a known or guessed stream key can silently download private recorded video content, with no public exploit or KEV status confirmed at time of analysis.

Privilege escalation in Cloud Foundry UAA (User Account and Authentication server) lets users who authenticate via a federated OIDC provider obtain the powerful uaa.admin scope even though operators intended to restrict that provider using the externalGroupsWhitelist configuration. The flaw manifests only when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES together with a wildcard (*) externalGroupsWhitelist entry, causing the wildcard to grant all mapped external groups as scopes - including uaa.admin. No public exploit has been identified at time of analysis, and the vulnerability requires a specific non-default IdP configuration.

WeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol without any authentication, allowing any adjacent-network attacker to impersonate either student or teacher roles. The teacher-impersonation path is the critical vector: posing as a teacher causes student workstations to initiate management connections back to the attacker, yielding remote control over every student endpoint in the lab. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-privilege, zero-interaction requirement within a reachable network makes exploitation straightforward for any insider or network-adjacent threat actor.

Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.

Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.

Remote Code Inclusion in Brainzcompany Zenius EMS 8.0 (through OAM Build 109) is achievable by unauthenticated attackers on an adjacent network who bypass authentication via an alternate path or channel (CWE-288) compounded by improper syntactic input validation. The two-weakness combination allows an attacker to cause the server to include and execute attacker-controlled remote code, yielding full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera.

CVE-2026-19816 is a vulnerability reported by Ubuntu with no public description, CVSS score, or CWE classification available at the time of analysis. The affected product is an Ubuntu package or system component, but the specific vulnerability class, attack vector, and impact cannot be determined from the available intelligence. No exploitation conditions, technical root cause, or patch details are derivable from current data.