CVE-2026-19869

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

CVE-2026-63641

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

CVE-2026-54730

In authentik, the AuthenticatorEndpointGDTCStage and GoogleChromeStageView components fail to verify that the out-of-band device attestation completed before advancing the authentication flow. An attacker who reaches a REQUIRED Chrome device-trust stage can skip the verification iframe and authen...

CVE-2026-54730 authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

CVE-2026-52723

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...

CVE-2026-52723 ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

GO-2026-6166 WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq

This report has been withdrawn with reason: "False positive". github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS tok...

CVE-2026-19869

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

EUVD-2026-61047

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

CVE-2026-73337

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

EUVD-2026-61034

Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

CVE-2026-73337

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

EUVD-2026-61029

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

EUVD-2026-61014

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-69189

Hoppscotch versions prior to 2026.6.0 contain an IDOR vulnerability in team and UserHistory GraphQL resolvers: authenticated workspace members can read other users' private request history, authorization headers, session data, and environment values, and modify or delete victim history entries. F...

CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...