CVE-2026-28148

CVE-2026-28148 affects the WordPress Headless Single Sign On plugin (versions 1.6 and earlier). The vulnerability is an unauthenticated bypass that could allow an attacker to bypass authentication, with CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, CRITICAL). Connected records do ...

EUVD-2026-57946

Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...

CVE-2026-28008

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...

CVE-2026-14681

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

UBUNTU-CVE-2026-14681

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

CVE-2026-14681

CVE-2026-14681 is a PostgreSQL vulnerability describing improper enforcement of message integrity in GSSAPI support. The issue allows a user to negotiate GSSAPI contrary to pg_hba.conf rules via an initial direct TLS connection, potentially permitting data exchange over TLS even when GSSAPI is re...

CVE-2026-14681 PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

CVE-2026-14672

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scramiterations count, because the authentication challenge for a...

CVE-2026-73611

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

CLEANSTART-2026-WX98343 Security fixes in grafana 12.4.6-r0

Package grafana version 12.4.6-r0 fixes 4 vulnerabilities: ghsa-jpcw-4wr7-c3vq, ghsa-r277-6w6q-xmqw, ghsa-gcjh-h69q-9w9g, ghsa-259r-337f-4rfw...

CLEANSTART-2026-YC09522 Security fixes in thingsboard 4.3.1.3-r5

Package thingsboard version 4.3.1.3-r5 fixes 4 vulnerabilities: CVE-2026-59869, ghsa-52cp-r559-cp3m, ghsa-h67p-54hq-rp68, CVE-2026-53550...

CVE-CICD-Security

CI/CD Tool CVE Vulnerability Reproduction Testbed Disclaim...

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626

CVE-2026-73626 is a HIGH severity (CVSS 3.1: 7.5) vulnerability in JupyterLab versions >=4.6.0, <=4.6.1 and

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73611 File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

CVE-2026-73611 File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

EUVD-2026-57804

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...