CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung 账户访问脚本 此脚本可用于获取受害者 Samsung 账户的访问权限，前提是受害者的三星设备上安装了特定版本的 Samsung Members，并且设备来自美国或韩国地区。 如何使用此脚本： 1. 托管一个 Web 服务器，并在其上托管一个包含以下链接的网页： :8000/yay.html&action=sso&from=ZZ&iso=ZZIntent;scheme=samsungrewards;package=com.samsung.android.voc;action=android.intent.action.VIEW;end;"y...

CVE-2026-94107: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

CVE-2026-52824

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...

CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

EUVD-2026-69137

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled...

CVE-2026-16279

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

CVE-2026-16279 Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

CVE-2026-16279 Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

CVE-2026-16279

An Improper Authorization vulnerability affects 3DPassport within 3DSwymer , spanning 3DEXPERIENCE Releases R2023x through R2026x . The flaw could allow an attacker to gain access to some user accounts. The CNA-assigned CVSS 3.1 score is 9.3 (Critical) , with a network-based attack vector, low co...

EUVD-2026-65320

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

CVE-2026-19851 Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

CVE-2026-19851

Tuleap Enterprise Edition versions 17.0 through 17.5 are affected by a Use of Default Password vulnerability. User accounts created during XML import retain default credentials, which could allow an unauthenticated remote attacker to gain access to those accounts. The CNA-assigned CVSS 3.1 score ...

CVE-2026-19851: Use of Default Password

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

PT-2026-78569

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 - OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with...

PT-2026-72122

Name of the Vulnerable Software and Affected Versions Laravel Socialite affected versions not specified Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in...

EUVD-2026-57899

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-72546

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72546

Attendize CVE-2026-72546 is an insecure direct object reference in the postInviteAttendee endpoint, exploitable by any authenticated event organiser to inject attendees and orders into events owned by other accounts. The endpoint loads the target event by ID without scoping to the authenticated o...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the OAuth login process when using a provider that does not guarantee verified email addresses. An attacker can gain unauthorized access to existing user accounts, including those with elevated privileges, by...

CVE-2026-39924 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...