Grafana - Exposes DingDing API Keys

An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1. id: CVE-2025-3415 info: name: Grafana - Exposes DingDing API Keys author: lucasribolli severity: medium description: | An inciden...

CVE-2025-71435

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435

Versions of Coder prior to 2.23.0 are vulnerable to a session expiration bypass when using OIDC without a refresh token. Authenticated users can maintain access after their OIDC token expires by keeping their APIKey cookie active through regular use, which extends the session indefinitely every 2...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

EUVD-2025-211113

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

PT-2026-116451

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435: Insufficient Session Expiration

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

Coder session mechanism issue vulnerabilities

Coder versions prior to 2.23.0 have a vulnerability related to session management. This vulnerability stems from a problem where sessions expire without proper handling. Certified users can continue to access the system even after the OIDC token expires and no refresh tokens are issued. By...

CVE-2026-104755 WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

EUVD-2026-102793

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

CVE-2026-104755 WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

CVE-2026-104755: Improper Privilege Management

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

PT-2026-115485

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start comms dispatcher wps ic comms::start comms, hooked on every front-end request, gates acces...

CVE-2026-57496

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...

CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...

EUVD-2026-102319

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...

CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...