CVE-2026-27478

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint /api/1.0/unity-control/auth/tokens. The endpoint extracts the issuer iss claim from incoming JWTs and uses it to...

CVE-2026-27478 Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint /api/1.0/unity-control/auth/tokens. The endpoint extracts the issuer iss claim from incoming JWTs and uses it to...

CVE-2026-27478 Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint /api/1.0/unity-control/auth/tokens. The endpoint extracts the issuer iss claim from incoming JWTs and uses it to...

CVE-2026-32096

creationtimestamp| type| source ---|---|--- 2026-03-11 19:16:18+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-32096 2026-03-12 03:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116213968591808640 2026-03-31 15:02:41+00:00|...

CVE-2026-0120

creationtimestamp| type| source ---|---|--- 2026-03-11 18:26:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116211946069059818...

CVE-2026-20117

creationtimestamp| type| source ---|---|--- 2026-03-11 16:37:39+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116211519204223592 2026-03-12 03:00:07+00:00| seen| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-xss-MrNAH5Jh...

CVE-2026-20118

creationtimestamp| type| source ---|---|--- 2026-03-11 16:37:38+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116211519204223592 2026-03-12 03:00:06+00:00| seen| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN 2026-03-...

CVE-2026-20116

creationtimestamp| type| source ---|---|--- 2026-03-11 16:37:38+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116211519204223592 2026-03-12 03:00:07+00:00| seen| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-xss-MrNAH5Jh...

GO-2026-4656 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange in github.com/pocket-id/pocket-id/backend

Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange in github.com/pocket-id/pocket-id/backend...

CVE-2026-22248

creationtimestamp| type| source ---|---|--- 2026-03-11 15:16:24+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-22248 2026-03-12 08:44:56+00:00| seen| https://infosec.exchange/users/obivan/statuses/116215322486970605 2026-03-12 08:44:57+00:00| seen|...

CVE-2026-0866

creationtimestamp| type| source ---|---|--- 2026-03-11 09:36:01+00:00| seen| https://infosec.exchange/users/decio/statuses/116209861321874609 2026-03-11 10:09:25+00:00| seen| https://t.me/ctinow/246968 2026-03-11 19:22:12+00:00| seen|...

CVE-2026-2631

creationtimestamp| type| source ---|---|--- 2026-03-11 09:00:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116209721838294392 2026-04-18 03:00:05+00:00| published-proof-of-concept| Telegram/-5TmsWj813MupXUk3oAfbbPwkALqIWcYveTIHrZR6Vdl1M 2026-08-15 11:00:03+00:00|...

CVE-2026-32136

creationtimestamp| type| source ---|---|--- 2026-03-11 08:30:16+00:00| published-proof-of-concept| https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-5fg6-wrq4-w5gh 2026-03-12 00:01:12+00:00| seen| https://infosec.exchange/users/offseq/statuses/116213261265217417 2026-03-12...

CVE-2026-28513

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse...

CVE-2026-29515

creationtimestamp| type| source ---|---|--- 2026-03-11 03:17:37+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-29515 2026-03-11 04:32:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116208668581685702 2026-03-22 02:38:09+00:00| seen|...

CVE-2026-28806

creationtimestamp| type| source ---|---|--- 2026-03-11 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116207599051092008...

PT-2026-24800

Name of the Vulnerable Software and Affected Versions Unity Catalog versions 0.4.0 and earlier Description Unity Catalog is an open, multi-modal Catalog for data and AI. A critical authentication bypass exists in the Unity Catalog token exchange endpoint, /api/1.0/unity-control/auth/tokens. The...

Microsoft Graph Enterprise Intelligence Collector

This Metasploit auxiliary module interacts with the Microsoft Graph API to perform enterprise intelligence collection. It supports authentication using Azure AD application credentials or an existing access token and enables enumeration of Azure users, SharePoint sites, OneDrive files, and Exchan...

CVE-2026-0124

creationtimestamp| type| source ---|---|--- 2026-03-10 23:32:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116207488529362845 2026-03-11 01:30:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116207951967793276...

CVE-2025-48611

creationtimestamp| type| source ---|---|--- 2026-03-10 23:19:18+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116207435885278449 2026-03-17 07:49:22+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhaidgdbzo27 2026-03-30 16:00:15+00:00| seen|...