CVE Watch18 de out. de 2026

CVE-2025-13315

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API aut

CVSS

9.8

Crítica

EPSS

31.2%

p98

KEV

—

Exploit Today

0-100

Publicado: 19 de nov. de 2025 · Última mod.: 18 de out. de 2026 · CWE-420

EPSS · 30d

31.2%EPSS · 30 dias32.5%

2026-10-112026-11-08

Descrição técnica

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Referências oficiais

www.rapid7.comhttps://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1050089.0 CRÍ

52.0%

——16No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.13d CVE-2026-1021345.4 MÉD

11.1%

——3Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.39d CVE-2026-619093.5 BAI

10.5%

——3An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.54d CVE-2026-776395.3 MÉD

33.4%

——10Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.22d CVE-2026-404355.3 MÉD

13.6%

——4When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.14d CVE-2026-402178.8 ALT

97.1%

——29LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.14d