13 matches found
CVE-2026-16302
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...
CVE-2026-16302 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...
PT-2026-97784
Name of the Vulnerable Software and Affected Versions Spectra Legacy – Gutenberg Blocks versions prior to 2.20.1 Description Sensitive information exposure occurs via the editor assets function, which exposes the uag insta linked accounts option through the uagb blocks info object without...
CVE-2026-50191: Improper Authentication
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...
CVE-2026-41418: Observable Timing Discrepancy
4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint POST /api/access-tokens. When an invalid username/email is provided, the server responds immediately 17ms average. When a val...
CVE-2019-18785
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials...
EUVD-2019-8493
Malware in sbrugna...
EUVD-2020-1427
Malware in sbrugna...
CVE-2024-28193: Exposure of Sensitive Information to an Unauthorized Actor
yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version 1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify A...
(0Day) Vinchin Backup and Recovery Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of API access tokens. The issue results from the use of a...
Command injection
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials...
