CVE Watch18 oct 2026

CVE-2025-13315

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API aut

CVSS

9.8

Crítico

EPSS

31.2%

p98

KEV

—

Exploit Today

0-100

Publicado: 19 nov 2025 · Última mod.: 18 oct 2026 · CWE-420

EPSS · 30d

31.2%EPSS · 30 días32.5%

2026-10-012026-10-28

Descripción técnica

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Referencias oficiales

www.rapid7.comhttps://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1050089.0 CRÍ

51.6%

——15No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.3d CVE-2026-1021345.4 MED

11.0%

——3Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.29d CVE-2026-619093.5 BAJ

10.4%

——3An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.44d CVE-2026-776395.3 MED

33.1%

——10Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.12d CVE-2026-404355.3 MED

13.5%

——4When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.4d CVE-2026-402178.8 ALT

96.8%

——29LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.4d