CVE-2026-19145

creationtimestamp| type| source ---|---|--- 2026-08-06 23:36:33+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051188055584250 2026-08-07 04:45:57+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:46:36+00:00| seen|...

CVE-2026-19137

creationtimestamp| type| source ---|---|--- 2026-08-06 23:09:54+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051083590682909 2026-08-07 04:45:39+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:46:21+00:00| seen|...

CVE-2026-64597

creationtimestamp| type| source ---|---|--- 2026-08-06 17:49:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117049822231737257...

CVE-2026-64592

creationtimestamp| type| source ---|---|--- 2026-08-06 17:35:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117049769070717664...

CVE-2026-66733

creationtimestamp| type| source ---|---|--- 2026-08-06 13:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117048804948021339 2026-08-06 13:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msg5m2k3dm27...

CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

CVE-2026-66885

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-8400

creationtimestamp| type| source ---|---|--- 2026-08-05 17:02:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117043976914506002...

CVE-2026-20263

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...

EUVD-2026-53452

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...

CVE-2026-64568

creationtimestamp| type| source ---|---|--- 2026-08-05 16:08:52+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117043765685985077 2026-08-12 20:45:35+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...

Malicious code in ccxt-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...

CVE-2026-71214

creationtimestamp| type| source ---|---|--- 2026-08-05 07:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117041727081914237 2026-08-05 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mscyzgcese2v 2026-08-05 09:24:05+00:00| seen|...

CVE-2026-9273

creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/117041373701599609 2026-08-05 06:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msctyppdsc2t 2026-08-05 07:04:04+00:00| seen|...

CVE-2026-70482

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

GHSA-RQ84-P6RR-VF89 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

CVE-2026-70482 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...

CVE-2026-70482

Open WebUI (self-hosted AI platform) versions 0.8.0–0.11.0 are affected. When ENABLE_OAUTH_TOKEN_EXCHANGE is true, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it via the provider’s userinfo endpoint without confirming which OAuth client issued the token. As ...

CVE-2026-70482 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...