CVE-2026-13476

IBM Informix Wire Listener vulnerability CVE-2026-13476 affects IBM Informix Dynamic Server versions 12.10, 14.10, and 15.0. An unauthenticated user could execute arbitrary commands with the system service account due to improper validation of user input, enabling remote code execution (RCE). CVS...

CVE-2026-13476 IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution

IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input...

CVE-2026-73305

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:26+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv 2026-08-14 01:01:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msyxhdipyh26...

EUVD-2026-57601

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

CVE-2026-73419

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

CVE-2026-73419

NextAuth.js/NMD vulnerability CVE-2026-73419 affects Auth.js OAuth/OIDC flow cookies. Prior to Auth.js @auth/core 0.41.3 and NextAuth.js 4.24.15 or 5.0.0-beta.32, state, nonce, and PKCE verifier were stored in global cookies not bound to the originating provider. On callback, a value from one pro...

CVE-2026-73419

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

CVE-2026-73303

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73326

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

EUVD-2026-57529

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

EUVD-2026-57416

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73326

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73326 CamaleonCMS Missing Authorization via Plugin Administration Endpoints

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73326

CVE-2026-73326 affects CamaleonCMS, where four unprotected plugin-administration endpoints (attack, front_cache, cama_meta_tag, cama_contact_form) allow an authenticated, low-privilege user to access and modify plugin settings without admin authorization. The underlying issue is missing authoriza...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306

Budibase (open-source low-code platform) is vulnerable prior to version 3.39.25 due to the login flow at POST /api/global/auth/:tenantId/login. The failure counter was incremented only for existing users, while emailLockout logic in packages/worker/src/middleware/emailLockout.ts surfaced X-Accoun...