PT-2026-106019

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description An authenticated user can retrieve API-token records via the 'GET /api/users/api-tokens/' endpoint. Additionally, the 'PATCH /api/users/api-tokens/token id/' endpoint allows a user to modify the allowe...

Debian dla-4822 : ruby-oauth2 - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4822 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4822-1 [email protected] https://www.debian.org/lts/security/...

PT-2026-106014

Name of the Vulnerable Software and Affected Versions @insumermodel/mppx-condition-gate versions prior to 3.0.0 @insumermodel/mppx-token-gate versions prior to 1.0.4 Description These packages provide conditional free-access wrappers for mppx payment methods. The issue occurs when the software...

PT-2026-104759

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

PT-2026-106017

🚨 CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the...

PT-2026-106211

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Logout functionality clears the browser's auth-token cookie but fails to revoke the corresponding server-side session. This allows a previously captured session token to remain valid and be used to...

PT-2026-104758

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server...

CVE-2026-105675: Observable Discrepancy

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

MAL-2026-17525 Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

CVE-2026-105217

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217

The Cockpit CMS (versions 2.12.0 before 2.14.1 ) is vulnerable to a flaw where it disables TLS certificate verification during the cron.php web worker restart request. This allows a man-in-the-middle attacker on the outbound path to the site_url to present a fraudulent certificate and capture the...

EUVD-2026-92120

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105208

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-78903-SWIFT-Kick-to-the-Creds

CVE-2026-78903 — SWIFT 자격 증명에 대한 킥 SWIFT API 게이트웨이 JWT 알고리즘 혼동 필드| 값 ---|--- 심각도| 9.1 치명적 공격 경로| 네트워크 영향받는 버전| 3.2.0 – 3.2.4 발견자| 𝕍𝕠𝕤𝕤🥷 설명 SWIFT API 게이트웨이의 치명적인 잘못된 구성으로 인해 공격자가 서버가 RS256을 기대하는 동안 HS256 알고리즘을 사용하여 JWT를 위조할 수 있습니다. 서버는 공개 RSA 키를 HMAC 비밀 키로 사용하여 토큰을 잘못 검증하므로, 공격자가 유효한 관리자 토큰을 위조할 수...

EUVD-2026-92106

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...