EUVD-2026-58500

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849

Budibase before 3.40.0 is affected by a cross-site request forgery in the chat-link handoff endpoint. The underlying issue allows an attacker to bind an external chat identity to a victim’s account via a phishing page that auto-submits a POST with a leaked confirmation token, enabling impersonati...

PT-2026-71906

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982

The CVE concerns RHOAI training-operator. Affected component: training-operator within Kubernetes environments. Privilege escalation arises from aggregating training job permissions onto native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough. A user ...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

MAL-2026-13209 Malicious code in @guangnao/claude-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespoke base64+XOR decoder functi...

CVE-2026-64797

Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts...

CVE-2026-64797

Summary (CVE-2026-64797) : A Joomla extension (IP Login by regularlabs.com) is vulnerable to IP spoofing through forwarded client-IP headers without a configured trusted proxy. The underlying issue is trust in forwarded headers, allowing an attacker to spoof the login IP and potentially impersona...

EUVD-2026-47815

IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts...

PT-2026-63508

Name of the Vulnerable Software and Affected Versions IP Login affected versions not specified Description The IP Login extension for Joomla trusts forwarded client-IP headers without requiring a configured trusted proxy. This allows attackers to spoof the IP address used for automatic login, whi...

CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-65007

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-65007

The Grav api plugin (grav-plugin-api) prior to v1.0.8 fails to properly authorize API key generation and revocation. It intercepts apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes callers solely on admin.login, the baseline permission for all panel use...

CVE-2026-53963

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that...

CVE-2026-50132

Summary (CVE-2026-50132) Budibase exposes a public GET endpoint GET /api/chat-links/:instance/:token/handoff that, before version 3.39.0, can silently link an attacker’s external chat identity (Slack/Discord/MS Teams) to a victim’s Budibase account without consent or CSRF protection. The flow: an...

CVE-2026-50132 Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

Budibase is an open-source low-code platform. Prior to 3.39.0, GET /api/chat-links/:instance/:token/handoff is a public endpoint no auth required that performs a permanent, state-changing operation: it binds an external chat identity Slack/Discord/MS Teams to an authenticated Budibase user accoun...

CVE-2026-50132 Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

Budibase is an open-source low-code platform. Prior to 3.39.0, GET /api/chat-links/:instance/:token/handoff is a public endpoint no auth required that performs a permanent, state-changing operation: it binds an external chat identity Slack/Discord/MS Teams to an authenticated Budibase user accoun...

CVE-2026-31387 Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...