{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aaip_pubacps_community/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aip_pub:acps_community:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-127279"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ACPs-community"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AIP-PUB"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-127279 exists in the Discovery Server component of AIP-PUB ACPs-community versions up to 2.2.0. The flaw resides within the discovery-server/app/main.py file and results in missing authentication, which may be exploited by remote attackers. The exploit is public.\u003c/p\u003e\n","date_modified":"2026-11-13T02:45:16Z","date_published":"2026-11-13T02:45:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127279/","summary":"A vulnerability in the Discovery Server component of AIP-PUB ACPs-community up to version 2.2.0 allows remote attackers to bypass authentication due to a flaw in discovery-server/app/main.py.","title":"AIP-PUB ACPs-community: Missing authentication in Discovery Server (CVE-2026-127279)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127279/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aip_pub:acps_community:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-127278"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["ACPs-community"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AIP-PUB"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-127278) has been identified in the AIP-PUB ACPs-community component in versions up to 2.2.0. The vulnerability exists within the 'send_verification_code' function in 'registry-server/app/account/service_auth.py'. The verify-code endpoint can be exploited remotely by manipulating the 'phone' argument, resulting in improper authentication. The exploit code has been made available to the public. While a related GitHub issue was closed as 'completed', there is no identified commit or pull request confirming a fix.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in improper authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eMonitor the environment for the identified vulnerable component and assess exposure to the verify-code endpoint.\u003c/p\u003e\n","date_modified":"2026-11-13T02:45:04Z","date_published":"2026-11-13T02:45:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-acps-community-auth-bypass-cve-2026-127278/","summary":"AIP-PUB ACPs-community up to 2.2.0 contains an improper authentication vulnerability in the send_verification_code function that can be triggered remotely via manipulation of the phone argument.","title":"AIP-PUB ACPs-community: Improper Authentication in verify-code Endpoint (CVE-2026-127278)","url":"https://feed.craftedsignal.io/briefs/2026-11-acps-community-auth-bypass-cve-2026-127278/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:aip_pub:acps_community:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}