CVE-2025-10423
A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation result
CVSS
3.7
Low
EPSS
0.5%
p38
KEV
—
Exploit Today
11
0-100
Published: Sep 15, 2025 · Last modified: Oct 19, 2026 · CWE-287 · CWE-804
0.5%EPSS · 30 days0.5%
2026-09-222026-10-19
A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1136827.4 HIG—
———Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.6hCVE-2026-1059498.8 HIG—
———Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.11hCVE-2026-112067——
———The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.6hCVE-2026-43844——
——0A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.6hCVE-2026-1134697.5 HIG—
——0A failure has been identified in the SNS during dynamic data files signature check.
A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.6hCVE-2026-1110907.8 HIG—
——0A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.6h