CVE-2026-92138: Insufficient Verification of Data Authenticity

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92133: Insufficiently Protected Credentials

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

CVE-2026-92814: Improper Neutralization of Input During Web Page Generation

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-76413: Improper Restriction of Security Token Assignment

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

PT-2026-94091

Name of the Vulnerable Software and Affected Versions quay-builder-qemu affected versions not specified Description A flaw exists where the release workflow uses the upstream Noelware/docker-manifest-action pinned to a mutable branch. A remote attacker could compromise this upstream action to...

PT-2026-94046

Name of the Vulnerable Software and Affected Versions OpenCVE versions 2.4.0 through 3.0.x Description An issue exists where the organizations API endpoint is not properly scoped to the organization associated with the token. Instead, it returns the memberships of the token creator. This allows...

PT-2026-93781

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Server Integration Plugin versions prior to 6.0.2 Description The OAuth authorization endpoint reads the oauth callback URL from the submitted form instead of using the server-side stored request token. This flaw allows...

CVE-2026-85387: Insufficient Session Expiration

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

VulnCheck KEV: CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

PT-2026-94001

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software. This flaw results from improper management of th...

PT-2026-93696

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description A cross-site request forgery CSRF issue exists in the 'portal.cgi' component. The anti-CSRF mechanism fails to validate the csrf token value parameter, accepting any...

CVE-2026-76187: Improper Authentication

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-82310: Insufficient Session Expiration

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

PT-2026-93416

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Deactivating a user account does not invalidate tokens issued to that account prior to the deactivation. While password authentication correctly rejects disabled accounts, the Co...

PT-2026-93310

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

PT-2026-93776

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Plugin versions prior to 1.2149.vcfc32c82b f7f Description The plugin caches the GitLab API client for alternative GitLab API token credentials using a cache key based solely on the credentials ID, failing to include the folder...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

Cache confusion in gitlab-plugin

gitlab-plugin allows jobs to override the globally configured GitLab API token credentials with an alternative one, and caches the GitLab API client it builds for those credentials. gitlab-plugin 1.2149.vcfc32c82bf7f and earlier derives the cache key from the credentials ID alone, omitting the...

CVE-2026-86823: URL Redirection to Untrusted Site

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

PT-2026-93421

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description The Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of the accepted id token. This allows an attacker who possesses a valid token...