File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

CVE-2026-61425

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

EUVD-2026-46068

The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-61425

CVE-2026-61425 affects the Joomla extension Gridbox (Gridbox

CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-61425

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-62183

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-61425: Authentication Bypass Using an Alternate Path or Channel

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

PT-2026-61683

The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

PT-2026-61811

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to v2.63.16 Description When creating a password-protected share or listing existing shares, the application includes the full bcrypt password hash and the secret token in the JSON response. This occurs because the...

VulnCheck KEV: CVE-2026-16232

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges...

CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token

Symptoms - Impact: An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration. Check Point is aware that this vulnerability is being exploited, impacting a ve...

Command Injection

Overview django-pyas2 is an AS2 file transfer Server built on Python and Django. Affected versions of this package are vulnerable to Command Injection via the cmdreceive and cmdsend fields in the Partner model, which are passed directly to the os.system function without sanitization. An attacker...

CVE-2026-9103

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

CVE-2026-9103 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

EUVD-2026-45242

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...

CVE-2026-63307

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...

CVE-2026-21760 Unauthorized Access to Admin Functionality via Forced Browsing

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality Forced Browsing vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints...

CVE-2026-21760

CVE-2026-21760 affects HCL DevOps Loop with an unauthorized access via forced browsing. The root cause is improper authorization checks that permit direct access to protected admin endpoints. CVSSv3.1 metrics indicate Network attack vector, Low privileges required, User interaction required, with...