CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

com.powsybl:powsybl-action-dsl (4.9.0), com.powsybl:powsybl-action-dsl-spi (4.9.0) +57 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (4.9.0)

com.powsybl:powsybl-computation-local MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-dsl 4.9.0 - com.powsybl:powsybl-action-dsl-spi 4.9.0 -...

com.powsybl:powsybl-action-simulator (4.5.0), com.powsybl:powsybl-action-util (4.5.0) +37 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (4.5.0)

com.powsybl:powsybl-computation-local MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-simulator 4.5.0 - com.powsybl:powsybl-action-util 4.5.0 -...

com.powsybl:powsybl-action-simulator (3.3.0), com.powsybl:powsybl-action-util (3.3.0) +28 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (3.3.0)

com.powsybl:powsybl-computation-local MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-simulator 3.3.0 - com.powsybl:powsybl-action-util 3.3.0 -...

PT-2026-30985

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo platform, an open source video platform, has an issue in the PayPal IPN v1 handler located at 'plugin/PayPalYPT/ipn.php'. This handler does not properly deduplicate transactions, which coul...

GHSA-77JP-MGCW-RFMR AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

Severity: High CWE: CWE-862 Missing Authorization Summary The plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin, so any...

AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

Severity: High CWE: CWE-862 Missing Authorization Summary The plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin, so any...

CVE-2026-34395 AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin...

EUVD-2026-17632

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin...

CVE-2026-34395 AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin...

CVE-2026-34395

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin...

CVE-2026-34395

WWBN AVideo

CVE-2026-34395 AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin...

PT-2026-29353

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The plugin/YPTWallet/view/users.json.php endpoint in AVideo allows any authenticated user to access personal information and wallet balances of all platform users. The endpoint incorrectly checks...

CVE-2026-27584

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction...

Missing Authentication for Critical Function

Overview @actual-app/sync-server is an actual syncing server Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SimpleFIN and PluggyAI integration endpoints. An attacker can access sensitive bank account balances and transaction information by...

GHSA-M2CQ-XJGM-F668 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Summary Missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. Impact This vulnerability allows an unauthenticated attack...

CVE-2026-27584

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction...

CVE-2026-27584

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction...

CVE-2026-27584 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction...