CVE-2023-27823
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
CVSS
9.8
Critical
EPSS
53.6%
p99
KEV
—
Exploit Today
30
0-100
Published: May 12, 2023 · Last modified: Jul 9, 2026 · CWE-287 · CWE-295
53.6%EPSS · 30 days53.6%
2026-09-212026-10-19
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1134705.4 MED—
———Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.6hCVE-2026-1059498.8 HIG—
———Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.6hCVE-2026-1134697.5 HIG—
——0A failure has been identified in the SNS during dynamic data files signature check.
A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.12hCVE-2026-1110907.8 HIG—
——0A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.13hCVE-2026-844902.0 LOW—
——0This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.6hCVE-2026-1074008.8 HIG—
——0IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.6h