Threat briefs

ChronoFrame versions 1.0.0 and earlier are vulnerable to a missing authentication flaw in API handlers, allowing unauthenticated attackers to reconfigure instance storage and site settings.

FastapiAdmin versions through 3.0 contain an authentication bypass vulnerability allowing unauthenticated attackers to obtain superuser sessions via unprotected auto-login endpoints.

The bbs-go application up to version 4.4.6 is vulnerable to an authentication bypass via the /api/login/google_one_tap endpoint due to missing validation of the Google ID token audience claim.

An authorization vulnerability in the sshportal management shell allows authenticated non-admin users to retrieve decrypted backend private SSH keys and bypass access controls.

OpenBMB StaffDeck versions through 0.5.6 contain an authentication bypass vulnerability allowing attackers to forge administrator session tokens via a hard-coded app_secret.

Helical Insight versions through 7.0.0 contain an authenticated SQL injection vulnerability in the /executeDatasource endpoint that allows attackers to manipulate backend database queries.

ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.

HestiaCP versions prior to 1.10.5 contain an authorization bypass vulnerability allowing non-privileged administrators to impersonate the ROOT_USER and execute arbitrary cron tasks.

AllData versions 0.7.1 and earlier are vulnerable to unauthenticated JDBC injection via the /jobJdbcDatasource/test endpoint, enabling remote attackers to perform arbitrary file read via the MySQL allowLoadLocalInfile parameter.

The netdisk-fast-download package through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt cloud-drive credentials via a hard-coded AES key.

An insecure direct object reference vulnerability in Jeepay versions 3.2.9 and earlier allows authenticated merchant users to overwrite arbitrary payment channel configurations, enabling payment redirection or service disruption.

Huly Platform versions through 0.7.432 contain a missing authorization vulnerability in the mergeSpecifiedPersons RPC, enabling authenticated account takeover.

Jpom versions through 2.11.12 contain an authorization bypass vulnerability allowing authenticated users to perform unauthorized file operations on SSH hosts across different workspaces.

WhaTicket Community through commit cf04795 is vulnerable to an authentication bypass via the /auth/signup endpoint, allowing unauthenticated attackers to self-register with administrator privileges.

A missing Sa-Token interceptor in LangChat allows unauthenticated remote attackers to access sensitive REST controllers, leading to full system compromise and credential exfiltration.

An unauthenticated authentication bypass vulnerability (CVE-2026-111692) in DataBuff ai-apm-web allows attackers to forge administrative session tokens using a hardcoded HMAC secret.

Simple Admin Core versions up to 1.8.7 contain a critical authentication bypass vulnerability allowing attackers to forge administrative JWTs using a hard-coded secret.

WeRSS version 1.5.3 and earlier contains a remote code execution vulnerability allowing unauthenticated attackers to bypass eval denylists via template parameters.

IceCMS versions through 4.1.5 contain a missing authentication vulnerability allowing unauthenticated attackers to perform full account takeover via the /User/updateUser API endpoint.

Misaka Danmu Server versions 2.8.9 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to modify sensitive configuration keys via the /api/ui/config-history/rollback endpoint.

Webreaper Damselfly versions 4.5.3 and earlier contain an authentication bypass vulnerability in API routes that allows unauthenticated attackers to escalate privileges and perform administrative actions.

UNC7017 performed an opportunistic supply chain attack by intermittently compromising AOMEI update servers to deliver backdoors, credential-harvesting pop-ups, and remote administration tools to Windows users.

The Bookly WordPress plugin up to version 28.2 contains multiple IDOR vulnerabilities in AJAX handlers allowing unauthenticated attackers to access customer data and delete arbitrary appointments.

Google Chrome contains multiple vulnerabilities that can be exploited by a remote, anonymous attacker to achieve arbitrary code execution or cause a denial-of-service condition.

A vulnerability in Matomo allows a remote, authenticated attacker to disclose sensitive information, potentially leading to unauthorized data exposure.

A vulnerability in Nutanix AOS and Nutanix Prism Central allows a remote, unauthenticated attacker to bypass security controls and execute arbitrary code with administrative privileges.

Devolutions Server contains multiple vulnerabilities that allow a remote, authenticated attacker to bypass security controls, perform information disclosure, and escalate privileges.

Multiple vulnerabilities in Red Hat OpenShift and RHEL, involving Quarkus and Netty components, enable remote attackers to perform information disclosure or trigger denial-of-service conditions.

A remote, unauthenticated attacker can exploit CVE-2018-1000632 within the virtuoso-opensource package on Red Hat Enterprise Linux to trigger a denial of service condition.

A vulnerability in FasterXML Jackson allows a remote, unauthenticated attacker to trigger a denial of service (DoS) condition in applications using the library for data processing.