EUVD-2026-92708

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

CVE-2026-105690 Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

CVE-2026-105690 Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

CVE-2026-105690

The open-source design platform Penpot contains a session management flaw in versions prior to 2.18.0 . When a user logs out, the application clears the browser's auth-token cookie but fails to revoke the corresponding server-side session . Consequently, a captured session token remains valid and...

CVE-2026-105690 Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675

The Ghost Node.js content management system is affected by a vulnerability where staff users with permissions to view staff invites can discover secret tokens for pending invites. This flaw exists in versions 4.39.0 through 6.64.0 . An attacker could exploit this to escalate privileges by accepti...

CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-105639

The open-source project management tool Plane is vulnerable to a pre-auth workspace invitation hijack prior to version 1.4.0 . The flaw exists because the signup flow creates a logged-in user for any submitted email without an out-of-band ownership check, while the User.email field is unique. An ...

CVE-2026-105639 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

CVE-2026-105639 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

CVE-2026-105639 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

EUVD-2026-92538

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...