Authentication Bypass

Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Code 132 allows an adjacent attacker to deliver arbitrary, unsigned firmware to the physical ear camera device. By spoofing the C6 Ear Camera's wireless identity and eliciting a single user confirmation, the attacker triggers the application to transmit firmware over an update channel that performs neither endpoint authentication nor cryptographic signature verification (CWE-306). No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; however, the adjacent-network vector and minimal social engineering threshold make exploitation realistic in clinical or close-proximity consumer settings.

Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and companion EarVision Android application (1.3.1) allow an adjacent-network attacker to reconstruct the device's access-point password without authentication. Once the attacker connects to the camera's private Wi-Fi network, the live video stream, device management interfaces, status pages, and the firmware-update endpoint become fully accessible. The vulnerability was disclosed via CISA ICS-CERT advisory VA-26-251-01 and carries a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability within the vulnerable system.

Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to man-in-the-middle attacks on adjacent networks. The C6 Ear Camera and its companion EarVision Android app (both at version 1.3.1) lack proper device authentication, allowing an adjacent network attacker to emulate the camera, intercept and manipulate device status responses, observe application traffic, and potentially trigger firmware-update behavior on the camera. Reported by CISA ICS-CERT; no public exploit code or KEV listing identified at time of analysis.

Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.

Account takeover in Snipe-IT before 8.7.0 allows low-privileged identity-provider users to hijack arbitrary Snipe-IT accounts by registering IdP usernames that are case or Unicode accent variants of existing victim usernames. The vulnerability exploits MySQL's default utf8mb4_unicode_ci collation, which conflates these variants during database lookups, enabling an attacker to be matched to a different user's record across all federated authentication paths - SAML, LDAP, and OAuth. Vendor-released patch 8.7.0 resolves the issue; no public exploit code or active exploitation has been identified at time of analysis.

Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to the API middleware group, allowing deactivated accounts to retain full REST API access through their existing Laravel Passport personal access tokens. Any deactivated user whose token has not been explicitly revoked can continue reading and writing assets, users, and licenses at their prior permission level, bypassing the offboarding control that correctly blocks web sessions. The most critical escalation path lets a deactivated account previously holding users.edit permission PATCH its own activation flag via /api/v1/users/{id} to permanently re-enable itself. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 8.7.0.

Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.

Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.

Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote unauthenticated retrieval of expired one-time secrets in PasswordPusher before 2.11.1 is enabled by a TOCTOU race condition in the expire_after_views view-limit enforcement logic. By issuing multiple simultaneous HTTP requests to the show endpoint, an attacker can read a secret that was configured to self-destruct after a single view, defeating the core confidentiality guarantee the tool is designed to provide. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, though the technique requires only basic HTTP concurrency tooling.

Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.

Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a network-positioned unauthenticated attacker to conduct man-in-the-middle attacks, intercepting and potentially modifying encrypted communications between the SCG and Dell's remote support infrastructure. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation yields high confidentiality and integrity impact on all intercepted support traffic.

Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated network-positioned attacker to conduct man-in-the-middle attacks against both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment forms, intercepting and potentially tampering with encrypted remote-support communications to achieve unauthorized access. Dell confirmed the vulnerability under advisory DSA-2026-382 with a CVSS 7.7 (High) rating; the AC:H metric reflects the MITM positioning prerequisite, which is the primary exploitation barrier. No public exploit code has been identified at time of analysis.

Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.

Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to exploit TLS/certificate handling weaknesses, leading to unauthorized access and high-availability impact. Both the Appliance (Virtual Edition) builds prior to 5.36.00.16 and Application builds prior to 5.36.00.00 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network vector and CVSS 8.2 score make this a priority patching item for environments running Dell infrastructure monitoring.

Improper certificate validation in Dell Secure Connect Gateway 5.0 exposes both Appliance and Application deployments to unauthenticated remote exploitation, enabling MITM-style attacks that bypass TLS trust enforcement and grant unauthorized access to communications relayed through the gateway. The Appliance variant is affected below version 5.36.00.16 and the Application variant below 5.36.00.00. No active exploitation has been confirmed by CISA KEV and no public exploit code is referenced, but the zero-authentication network vector makes patching urgent for any internet-reachable SCG deployment.

Certificate hostname validation failure in Dell Secure Connect Gateway (SCG) 5.0 enables an unauthenticated remote attacker positioned as a network man-in-the-middle to present a valid TLS certificate for a different host, defeating the connection's trust model and gaining unauthorized access to intercepted communications. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are confirmed affected per Dell DSA-2026-382. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H CVSS metric reflects the non-trivial network positioning prerequisite.

Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables an unauthenticated remote attacker with a man-in-the-middle network position to intercept and modify encrypted communications between the SCG platform and Dell's support infrastructure. Rated CVSS 7.4 (CWE-295) with high confidentiality and integrity impact, this flaw is particularly sensitive given that SCG routinely carries privileged support telemetry and credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released patches in advisory DSA-2026-382.

Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.

Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.

Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.

Improper certificate validation in Chrome's Federated Credential Management (FedCM) component — fixed in Chrome 153.0.8010.36 — lets a remote attacker who controls crafted network traffic, combined with social engineering of the victim, bypass web origin policy and expose cross-origin identity data. The flaw is a confidentiality-only issue (no integrity or availability impact) and Chrome rates it security severity Low, despite a 7.5 CVSS base score; EPSS is only 0.15% (4th percentile), it is not in CISA KEV, and no public exploit code has been identified at time of analysis. Vendor-released patch: 153.0.8010.36.

Authentication bypass in Siam Ordering (siam-server) 1.0.0 lets remote attackers log in as any user, merchant, or administrator by supplying a hardcoded master verification code that ships with the server. The flaw is rooted in a hardcoded credential (CWE-259) rather than a memory-safety or logic error, so every deployment of version 1.0.0 that exposes the verification endpoint is potentially affected, with full confidentiality, integrity, and availability impact once a session is obtained. No public exploit code has been identified and the EPSS score is low (0.24%, 16th percentile), but the issue is trivially severe if the code value is known or recoverable, and no vendor-released patch was identified in the available data.

Authentication bypass in s-pms SPMS-Server (through v1.0) allows remote, unauthenticated attackers to forge valid administrative session tokens because a hardcoded default access-token secret is shipped in the core configuration file and is never overridden in the production environment profile. An attacker who extracts that secret from the publicly available source can then sign their own tokens and reach protected backend APIs with full administrative privileges, giving high confidentiality, integrity and availability impact (CVSS 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.24% (15th percentile); the real limiter is deployment hygiene, since any operator who rotates or overrides the token secret removes the flaw entirely.

Token replay vulnerability in macropay-solutions/maravel-framework prior to version 10.74.0 enables attackers holding invalidated JWT tokens to bypass authentication and regain unauthorized API access after a predictable 2-hour window. The root cause is a lifecycle collision: the framework's O(1) Atomic Lazy Eviction model silently caps all tagged cache entries at 7,200 seconds, truncating the tymon/jwt-auth blacklist's intended 14-day retention and leaving revoked tokens cryptographically valid but logistically unblocked. No public exploit code has been identified and the CVE is not in CISA KEV, though the attack mechanism is deterministic and requires no specialized tooling.

Local privilege escalation in Waves Central for macOS (versions up to 16.6.2) allows any authenticated local user to gain root code execution by abusing a flawed XPC client authorization scheme in the product's privileged helper service. The helper validates connecting XPC clients by performing a certificate-chain equality comparison against itself rather than enforcing a pinned code requirement (application identifier and Apple Team ID), meaning any process carrying the Waves signing certificate can impersonate a legitimate client and instruct the helper to run arbitrary scripts as root. No public exploit has been identified at time of analysis; a vendor-released fix is available in version 17.0.

Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.

Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis.

Roo-Code's auto-approve shell execution mechanism through version 3.54.0 can be bypassed by exploiting a word-boundary mismatch between the approval gate's shell tokenizer and bash, allowing commands explicitly denied in the user's allowlist to execute silently on the developer's machine. An attacker who can influence the command string reaching the auto-execute pipeline - most plausibly via prompt injection through malicious repository content or crafted AI interactions - prefixes a denied command with an allowlisted token followed by a hash character and separator; the approval gate passes the token as safe while bash interprets the hash as a comment delimiter and executes the trailing denied payload with the agent's full privileges. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a detailed technical writeup is publicly available on GitHub, lowering the barrier for exploitation.

Command allowlist bypass in Roo-Code through version 3.54.0 enables execution of shell commands that users explicitly denied from auto-approval. The vulnerability stems from the shell command parser's failure to recognize the bash pipe operator `|&` as a command separator - a crafted pipeline prefixed with an allowlisted command followed by the stderr-redirecting pipe and a denied command passes parser validation while bash executes the entire pipeline, including the denied component, with full agent privileges on the developer's workstation. A public proof-of-concept writeup exists on GitHub; no active exploitation has been confirmed by CISA KEV.

Incorrect Authorization (CWE-863) in Adobe Commerce allows unauthenticated remote attackers to bypass security controls and gain unauthorized read access across a changed security scope boundary. Affected products span Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, all prior to the August 2026 security patches released under APSB26-138. No public exploit code has been identified and no active exploitation is confirmed in CISA KEV, but SSVC rates the vulnerability as automatable, making mass scanning a realistic near-term threat once technical details become more widely known.

Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows a high-privileged attacker to bypass access control boundaries and perform unauthorized writes to resources outside their intended scope, with the scope change (S:C) amplifying impact to components beyond the directly vulnerable module. All supported branches of Adobe Commerce (2.4.4-2.4.9), Magento Open Source (2.4.6-2.4.9), and Commerce B2B (1.3.3-1.5.3) prior to the August 2026 security patch cycle are affected. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires an already-authenticated admin-level session.

Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows unauthenticated remote attackers to escalate privileges and gain write access to restricted platform resources without user interaction. Scope change is confirmed: successful exploitation crosses privilege boundaries within the Commerce platform, granting access to administrative or otherwise protected functionality. SSVC classifies technical impact as total and the attack as automatable, elevating operational priority despite no active exploitation currently recorded in CISA KEV.

Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows remote unauthenticated attackers to bypass access controls and read sensitive platform data, achieving a privilege-escalation effect without any user interaction. The flaw stems from CWE-863 (Incorrect Authorization), where authorization checks fail to enforce the correct permission boundaries, letting an unauthenticated network request access resources restricted to higher-privilege roles. No public exploit code has been identified at time of analysis, but the combination of PR:N and C:H on a major e-commerce platform makes this a meaningful exposure for confidential business and customer data.

Incorrect Authorization in Adobe Commerce allows remote unauthenticated attackers to escalate privileges and access sensitive information without any user interaction. The vulnerability, rooted in CWE-863, affects Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3, covering a broad range of production deployments. No public exploit code has been confirmed and CISA KEV does not list active exploitation, but SSVC flags the flaw as automatable, raising concern for mass-scanning campaigns against exposed storefronts.

Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.

Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).

Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.

Missing authorization in Microsoft Entra ID allows an attacker who already holds a valid low-privilege identity - a compromised user account, guest account, or service principal - to elevate privileges over the network without any user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Microsoft has published an advisory through MSRC (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83941), but no public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is only 0.73% (52nd percentile), so this is a genuine priority-worthy finding rather than an emergency. Because Entra ID is a Microsoft-operated multi-tenant cloud service, the affected code is centrally managed and the exact tenant configuration or feature exposing the missing check is not detailed in the advisory.

Security feature bypass in Visual Studio Code before 1.136.2 allows a remote, unauthenticated attacker to circumvent a protection mechanism via a failing-open (CWE-636) code path, resulting in high confidentiality impact and limited integrity impact across a changed scope. The vulnerability is reachable over the network with low complexity but requires user interaction, suggesting an attacker must induce the victim to open a crafted workspace, file, or URI. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Microsoft has released a patch.

Security feature bypass in Visual Studio Code (versions 1.0.0 through below 1.136.2) allows a remote unauthenticated attacker to circumvent a protective security control via an interpretation conflict in the editor's processing pipeline. The vulnerability requires user interaction (UI:R) - a victim must open or interact with attacker-influenced content - after which the scope change (S:C) and high confidentiality impact suggest sensitive host data or credentials may be exfiltrated beyond the process boundary. No public exploit or CISA KEV listing has been identified at time of analysis.

Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a protection mechanism when a user is lured into interacting with malicious content (UI:R). Rooted in an incomplete comparison that omits required factors (CWE-693), the flaw carries a scope-changed CVSS 9.6 with full confidentiality, integrity, and availability impact, consistent with a trust/security-control bypass that can extend beyond the editor's initial boundary. A vendor patch exists; no public exploit is identified at time of analysis.

HTTP request smuggling in Visual Studio Code (versions 1.0.0 through 1.136.2) enables unauthenticated network attackers to bypass security controls through inconsistent interpretation of HTTP request boundaries. The CVSS scope change (S:C) signals that impact extends beyond the editor itself - smuggled requests can affect back-end services or proxies that VS Code communicates with, resulting in high confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, unauthenticated nature of the attack surface warrants prompt patching.

Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide affected version range (spanning a very broad Android release history) increases exposure surface considerably.

Privilege escalation in Microsoft SQL Server (2017 through 2025) allows a low-privileged authenticated network attacker to gain full administrative control via improper access control enforcement. The vulnerability spans four major SQL Server release trains - 2017, 2019, 2022, and 2025 - including both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit code has been identified at time of analysis, but the low attack complexity and broad affected surface across enterprise SQL Server deployments make this a meaningful priority for patching.

Security feature bypass in Microsoft Windows iSCSI (Initiator/Target service) lets a remote, unauthenticated attacker defeat the protocol's weak authentication over the network, per Microsoft's advisory carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact. The flaw spans essentially the entire supported Windows Server line (2012 through 2025) plus Windows 10 (1607/1809), and a vendor patch is available. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.

Use-After-Free (CWE-416) in the Windows Routing and Remote Access Service enables an unauthenticated attacker positioned on an adjacent network to execute arbitrary code on affected Windows systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025 and Windows 10/11 client versions, making the exposure surface substantial in enterprise environments where RRAS is deployed as a VPN or routing endpoint. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H/A:H impact and adjacent-network unauthenticated attack path make it a high-priority patching target for organizations running RRAS-enabled servers.

Privilege elevation in Spring Cloud Azure (versions 1.0.0 up to but not including 7.4.0) lets a network-based, unauthenticated attacker bypass improper authentication logic (CWE-287) to gain elevated privileges. Reported by Microsoft (MSRC) with a vendor patch available; no public exploit identified at time of analysis and neither KEV nor EPSS/POC signals are present in the provided data.

Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.

DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. Successful cache poisoning yields full confidentiality, integrity, and availability impact - enabling credential interception, traffic redirection, and service disruption for any client relying on the compromised resolver. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.

Network-based privilege escalation in Microsoft Exchange Server lets an already-authenticated attacker gain higher privileges by exploiting a missing authorization check (CWE-862). Affected on-premises builds include Exchange 2016 CU23, Exchange 2019 CU14/CU15, and the Subscription Edition; Microsoft has released fixed cumulative-update builds via MSRC. No public exploit identified at time of analysis and the flaw is not on CISA KEV, but its 9.1 CVSS with scope change and full CIA impact makes it a high-priority patch for internet-facing mail infrastructure.

Privilege escalation in Windows Shell affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to achieve full system compromise with no user interaction required. The root cause is CWE-306 - a critical internal Shell function that lacks an authentication or authorization gate, allowing a standard user account to invoke privileged operations and elevate to SYSTEM. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has issued patches via Windows Update.

Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged attacker to execute arbitrary code over the network by exploiting an improper access control flaw (CWE-284). The vulnerability affects build versions from 16.0.0 up to but not including 16.0.20326.20090, which Microsoft has patched. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.

Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.

Authentication bypass in DeepSeek Harness before 0.1.2-alpha.1 lets attackers seize full control of the local agent by spoofing the HTTP Host header, because the control-plane API trusts the client-supplied Host value instead of the actual TCP connection origin. An unauthenticated attacker who lures an operator's browser to a malicious page (via DNS rebinding or a cross-site 'simple' POST) can invoke privileged methods such as commands/execute with danger-full-access, escalate approval policies to unconfined execution, and exfiltrate all stored conversations. No public exploit is identified at time of analysis, though the fixing commit and a VulnCheck advisory document the exploitation mechanics in detail.

Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform.

UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin' role credentials - or unauthenticated attackers with physical device access - to disable Secure Boot protections and execute unauthorized software at boot time. The flaw stems from UEFI Shell memory-write commands remaining accessible while Secure Boot is active, enabling direct manipulation of Secure Boot validation variables in UEFI memory. A successful exploit undermines firmware integrity controls, potentially allowing persistent pre-OS implants or untrusted bootloaders on enterprise server infrastructure. No public exploit code or CISA KEV entry has been identified at time of analysis.

JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.

Unauthenticated information disclosure in WWBN AVideo through version 29.0 allows any remote attacker to retrieve live-stream keys, private EPG programme schedules, and server identifiers from the exposed `plugin/PlayLists/epg.json.php` endpoint without credentials. The PHP endpoint performs no authentication check (CWE-306), and because the API accepts sequential user and playlist IDs, an attacker can enumerate the full set of sensitive broadcast credentials across all accounts on an instance. No public exploit or CISA KEV listing has been identified at time of analysis, though the issue is trivially exploitable given its network-accessible, zero-prerequisite nature.

Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).

PGP two-factor authentication bypass in AVideo's LoginControl::verifyChallenge() allows a network-accessible attacker holding only a valid account password to completely circumvent the PGP 2FA step and obtain full authenticated session access. The flaw stems from PHP's loose equality operator (==) comparing the submitted challenge against an unset session variable, which evaluates as true when an empty value is submitted - a classic PHP type-juggling weakness. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the bypass is trivially reproducible by any credential-holding attacker.

Email two-factor authentication bypass in WWBN AVideo (through commit c3edcc274) allows an attacker who already possesses valid account credentials to skip device-enrollment 2FA entirely. The root cause is a cache invalidation failure in the sqlDAL layer: empty result sets are cached, and writeSql never purges them, so when a new-device login triggers 2FA code generation, the confirmation code hash is computed from a stale empty cache entry rather than a freshly written value - causing the check to silently pass without a valid code. No public exploit code is confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the bypass is straightforward for any attacker with stolen or leaked passwords.

Authorization bypass in AVideo's live-streaming endpoint allows unauthenticated remote attackers to publish content to any user's RTMP stream by exploiting a hardcoded session cookie. In saveLive.php and related endpoints, PHP cookie precedence causes a session cookie named 'key' with the constant value 'value' to silently override the legitimate $_REQUEST['key'] stream key parameter check, effectively nullifying per-user stream authentication. Any attacker who reads this disclosure now possesses the exact bypass credential; no public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nature of exploitation (a known constant) makes it functionally equivalent to a zero-authentication bypass.

Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) allows an authenticated remote attacker to run arbitrary code on the server by abusing a missing authorization check (CWE-862). Because a low-privileged account is sufficient (CVSS:3.1 PR:L) and the flaw escapes its security scope (S:C) to fully compromise the host, Ivanti rated it 9.9 critical. No public exploit identified at time of analysis and it is not on CISA KEV, but this is one of a cluster of critical ITSM RCEs Ivanti disclosed in the same advisory.

Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) lets an authenticated attacker run arbitrary code on the server by reaching a function that fails to enforce authorization (CWE-862). Any low-privileged account is sufficient, and the CVSS 9.9 scope-change rating reflects that successful exploitation compromises confidentiality, integrity, and availability of the server and downstream components. No public exploit has been identified at time of analysis, but the vendor-issued advisory and 9.9 severity make this a top-priority patch item.

Remote authenticated arbitrary code execution affects Ivanti Neurons for ITSM before 2026.2, where a missing authorization check (CWE-862) lets a low-privileged authenticated user reach functionality that executes code on the server. Rated CVSS 9.9 with a scope-change vector, it grants full confidentiality, integrity, and availability compromise of the ITSM host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (2026.2) is available.

Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to gain administrative-level access to the appliance. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the flaw permits circumventing the primary authentication mechanism - likely via an unprotected API endpoint or secondary management interface - without any credentials or user interaction. No public exploit or CISA KEV listing is associated at time of analysis, though the vendor self-disclosed via a security advisory, and the all-high C:H/I:H/A:H impact from administrative compromise makes this a critical patching priority for enterprises running Sentry in mobile security gateway roles.

Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloads, because the platform performs no duplicate transaction ID check before processing incoming events. An attacker who possesses a legitimately captured webhook payload - for instance, from a prior genuine purchase - can retransmit it repeatedly to the XenForo webhook endpoint, triggering repeated subscription activations and elevating account privileges without additional payment. No public exploit has been identified at time of analysis, and a vendor patch (2.3.13) is available.

Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signature verification routine: when the incoming `auth_algo` header value cannot be mapped to a supported hash function, the verification function incorrectly returns `true`, causing the application to accept fabricated webhook payloads as legitimate PayPal events. Any XenForo installation with PayPal REST payment integration enabled prior to version 2.3.13 is affected. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable against the webhook endpoint by any network-accessible attacker.

Multi-factor authentication bypass in XenForo before 2.3.13 allows a network-accessible authenticated attacker who knows a target account's password to complete login as that user without possessing their registered passkey. The WebAuthn assertion handler performs a global credential lookup that accepts any registered passkey - including the attacker's own - without verifying the credential belongs to the user whose session is pending, nullifying the passkey TFA layer. Both public forum and admin control panel (ACP) login paths are vulnerable. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.

Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).

OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.

XenForo's OAuth2 token endpoint before version 2.3.13 fails to bind the redirect URI to its associated authorization code, enabling an attacker who controls any allowlisted redirect URI to exchange an intercepted authorization code using a mismatched URI and steal the resulting OAuth2 tokens. The flaw affects XenForo installations using OAuth2-based third-party integrations across all versions covered by CPE cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*. Vendor-released patch is available as XenForo 2.3.13; no public exploit code or CISA KEV listing has been identified at time of analysis.

Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.

Missing authorization in the cvlaunchd daemon of Commvault Cloud allows low-privileged authenticated users to bypass command execution authorization controls, potentially achieving full system compromise across confidentiality, integrity, and availability dimensions. All major Commvault installation components are affected - Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - across four version branches (11.36, 11.40, 11.44, 11.46). No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment surface and high-impact CVSS profile make patching urgent for enterprise operators.

Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.

Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-facing attackers to interact with the metrics upload functionality without credentials. The CVSS 4.0 vector (PR:N, VA:H, VI:L) confirms the endpoint lacks authentication entirely, enabling service disruption and limited metrics data manipulation. No public exploit code has been identified at time of analysis, and the vendor has released a maintenance update resolving the condition.

Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.

Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.

Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.

Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.

Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.

Unauthenticated adjacent-network host takeover in ASUS Control Center Express Agent exposes critical management functions without any authentication check (CWE-306), allowing any attacker with network adjacency to directly connect to the agent and fully control the host. The attack is contingent on the host having an active login session at the time of exploitation. No public exploit code has been identified at time of analysis, but the unauthenticated nature and high CIA impact make this a meaningful risk in environments where ASUS Control Center is deployed across managed workstations or servers.

Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.

Broken access control in springboot-project v1.0.0 lets remote unauthenticated attackers reach every seller-management interface through a flaw in the SellerAuthorizeAspect authorization component. Attackers can enumerate all products and orders, toggle products on/off sale, finish or cancel orders, and modify categories with no credentials. No public exploit identified at time of analysis beyond the reporter's write-up; EPSS is low at 0.18% (7th percentile).