Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.
CVE-2026-45781 is a vulnerability in the modelcontextprotocol (MCP) registry prior to version 1.7.9. The issue arises because the OCI ownership validation fails open when the upstream OCI registry returns an HTTP 429 (Too Many Requests) response. This failure allows any authenticated publisher to bind namespaces they do not control to OCI images, bypassing the critical label-match ownership check. The vulnerability is specific to OCI packages; other package types enforce stricter validation. This flaw has a low severity score and no known exploits in the wild. A fix was introduced in version 1.7.9.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
OpenClaw versions before 2026.4.8 have a vulnerability where an approval-timeout fallback mechanism allows bypassing explicit user approval for inline eval commands on gateway and node execution hosts. This flaw enables attackers with limited privileges to execute commands that should require explicit approval, violating the intended security controls.
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.
fast-jwt versions 6.1.0 and earlier do not validate the 'crit' (Critical) Header Parameter in JSON Web Tokens as required by RFC 7515 §4.1.11. This means that if a token contains a 'crit' array listing extensions that fast-jwt does not recognize, the library incorrectly accepts the token instead of rejecting it. This behavior violates the mandatory validation requirement defined in the RFC and can lead to insufficient verification of data authenticity.
CVE-2026-27448 is a vulnerability in pyOpenSSL versions from 0.14.0 up to but not including 26.0.0. It involves unhandled exceptions in user-provided callbacks to set_tlsext_servername_callback, which cause the connection to be accepted rather than rejected. This behavior is a failure to fail securely ('failing open'), potentially allowing bypass of security-sensitive logic in these callbacks. The issue was fixed in pyOpenSSL version 26.0.0 by changing the behavior to reject connections on such exceptions.
An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.
An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed in version 3.0.18. To workaround this issue, avoid blowfish-256.
CVE-2024-43532 is a high-severity elevation of privilege vulnerability in the Remote Registry Service of Microsoft Windows 10 Version 1507 and related versions. The flaw is categorized as CWE-636, indicating a failure to fail securely ('Failing Open'). This vulnerability allows an attacker with low privileges to potentially gain higher privileges on the affected system. Microsoft has released official fixes for all affected versions.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.