CVE-2026-87979: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

PT-2026-97327

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2 Description In this PHP-based content management system, the rex list::getSortColumn function in redaxo/src/core/lib/list.php fails to verify if the requested column was registered via setColumnSortable. An...

PT-2026-97186

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description The plugin fails to verify the request signature within the card-token branch of its payment webhook. This flaw allows unauthenticated attackers to enumerate register...

CVE-2026-92692: Improper Neutralization of Special Elements used in an SQL Command

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...

CVE-2026-16426

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-16426 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-16426 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-16426

IBM Concert versions 1.0.0 through 3.0.0 are vulnerable to server-side request forgery (SSRF) . This vulnerability allows an authenticated attacker to initiate unauthorized requests from the system, which may result in network enumeration or the facilitation of additional attacks. No specific rem...

htb-writeups

htb-writeups My walkthroug...

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

GHSA-8FCF-V89G-XPG6 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

EUVD-2026-84014

Tinyauth: User enumeration attack by timing oracle...

Tinyauth: User enumeration attack by timing oracle

Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins. PoC Setup a tinyauth server with a local user. It can be over the network. Try to log in with the local user, using ...

GHSA-456H-WW26-F758 Tinyauth: User enumeration attack by timing oracle

Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins. PoC Setup a tinyauth server with a local user. It can be over the network. Try to log in with the local user, using ...

EUVD-2026-84532

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010

Traefik (open source HTTP reverse proxy and load balancer) versions 3.6.11 through before 3.7.13 contain an unauthenticated username-enumeration timing oracle in the BasicAuth middleware. The checkPassword function in pkg/middlewares/auth/basic_auth.go constructs the singleflight key from the sub...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-95655 Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...