What needs attention now.

Improper authentication in envoy

• envoy
• Authentication bypass

Subnet Solutions PowerSYSTEM Center SQL Injection

• Subnet Solutions PowerSYSTEM Center 2024
• Subnet Solutions PowerSYSTEM Center 2026
• SQL injection

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

• Subnet Solutions PowerSYSTEM Center 2020
• Subnet Solutions PowerSYSTEM Center 2024
• Broken access control

Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

• Memory corruption
• CWE-252

<1.2.7 · fixed in 1.2.7

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

• kubeflow pipelines
• Broken access control

Incorrect validation of TLS certificates in the MatchPoint Android app

• TPC Software Matchpoint
• Weak cryptography or TLS

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

• TPC Software Matchpoint
• Broken access control

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

• TPC Software Matchpoint

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

• BTCPay Server
• Hard-coded credentials
• Information disclosure

Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

• jhuckaby Cronicle
• Other injection
• Broken access control

OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

• openemr
• Broken access control

FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

• signalwire freeswitch
• Authentication bypass
• Weak cryptography or TLS

FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

• signalwire freeswitch
• Command injection
• CWE-749

FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

• signalwire freeswitch
• Memory corruption
• CWE-681

SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

• SuiteCRM
• Code injection

SuiteCRM: LFI to RCE via AOW_WorkFlow

• SuiteCRM
• File inclusion

LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

• LMFDB
• Code injection

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

• Hard-coded credentials
• CWE-346

<1.25.20 · fixed in 1.25.20

OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution

• tinyhumansai openhuman
• Command injection
• Broken access control

OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

• tinyhumansai openhuman
• Code injection
• Broken access control

Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

• ultravioletrs cocos
• CWE-346

Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

• Apache Software Foundation Apache OFBiz
• Authentication bypass

Apache OFBiz: Unauthenticated RCE via login-page widget injection

• Apache Software Foundation Apache OFBiz
• Code injection

Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Weak cryptography or TLS

Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

• Apache Software Foundation Apache Juneau
• Path traversal

Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

• Apache Software Foundation Apache Juneau
• Cross-site scripting (XSS)

Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

• Apache Software Foundation Apache Juneau
• Other injection

Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

• Apache Software Foundation Apache Juneau
• Hard-coded credentials

Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

• Apache Software Foundation Apache Juneau
• Information disclosure

Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

• Apache Software Foundation Apache Juneau
• Information disclosure

Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

• Apache Software Foundation Apache Juneau
• Cross-site request forgery (CSRF)

Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

• Apache Software Foundation Apache Juneau
• Code injection

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

• Security For WooCommerce
• Broken access control

OS command injection in OPNsense os-acme-client

• OPNsense os-acme-client
• Command injection

Integer underflow in G4KLX DStarGateway

• G4KLX DStarGateway
• Memory corruption

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy

• kyverno
• Privilege escalation

Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

• kyverno
• Path traversal

Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

• kyverno
• CWE-436

Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

• kyverno
• Broken access control

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

• kyverno
• Broken access control

Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

• kyverno
• Privilege escalation

Edimax BR-6208AC mp command injection

• Edimax BR-6208AC
• Other injection
• Command injection

Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

• pocket-id
• CWE-345

VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Authentication bypass

GLPI: MFA bypass

• glpi
• Authentication bypass

VitaFit Cloud API Broken Access Control via S3 Token Endpoint

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Hard-coded credentials

Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

• readest
• Server-side request forgery (SSRF)

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

• gpustack
• Authentication bypass
• Weak cryptography or TLS

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

• gpustack
• Authentication bypass
• CWE-346

Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

• xerrors Yuxi
• Command injection
• Broken access control

IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL

• IBM Watson Speech Services Cartridge
• Memory corruption

Comfast CF-WR632AX Multipart webmgnt path traversal

• Comfast CF-WR632AX
• Path traversal

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

• vtenext
• CWE-620

WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

• WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
• Authentication bypass

Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again

• Sonatype Nexus Repository 3
• Authentication bypass

Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

• Linksys E5350
• Authentication bypass

ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

• espressif esp-idf
• Memory corruption

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

• bitcoinjs-lib
• CWE-354

Linksys E5350 apply.cgi system os command injection

• Linksys E5350
• Command injection

Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection

• Linksys WRT54GL
• Command injection