CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

EUVD-2026-56104

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-72774

The CVE CVE-2026-72774 affects n8n before 1.123.67, 2.31.5, and 2.32.1. It is a credential authorization bypass in the HTTP Request node. The root cause is that the pre-execution permission check compares the unresolved expression, skipping the ownership check and loading the credential at execut...

CVE-2026-72774 n8n before 1.123.67 Authentication Bypass via HTTP Request Node

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution...

CVE-2026-72772 n8n before 2.32.1 Authentication Bypass via Token Exchange

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

CVE-2026-72772

n8n

CVE-2026-72772 n8n before 2.32.1 Authentication Bypass via Token Exchange

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

CVE-2026-72749

Technical details about CVE-2026-72749 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-56136

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...

CVE-2026-72746

...

CVE-2026-72746

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241...

CVE-2026-72746

Removed by vendor...

CVE-2026-72746

...

CVE-2026-72746

CVE-2026-72746 is rejected/withdrawn by the CNA as a duplicate of CVE-2026-73241.

CVE-2026-72746 FreeRDP before 3.30.0 RDSTLS Server Authentication Bypass via PDU-type Confusion

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...

CVE-2026-72745

Removed by vendor...

EUVD-2026-56044

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72601

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72601 CSZ CMS CSZ CMS - Broken Access Control

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72561

CVE-2026-72561 describes a broken access control in Peppermint Lab Peppermint. Through commit ba6e217, any authenticated non-administrative user can reconfigure the platform’s global OIDC/SSO settings via an unprotected configuration endpoint that performs no administrative role check before appl...