CVE-2026-28806

Improper Authorization vulnerability in nerves-hub nerveshubweb allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to...

CVE-2026-28806 Improper authorization in device bulk actions and device update API allows cross-organization device control

Improper Authorization vulnerability in nerves-hub nerveshubweb allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to...

CVE-2026-28806

CVE-2026-28806 describes an improper authorization in nerves-hub_web that allows cross-organization device control via device bulk actions and the device update API. Missing authorization checks enable authenticated users to target devices belonging to other organizations by manipulating device i...

EEF-CVE-2026-28806 Improper authorization in device bulk actions and device update API allows cross-organization device control

Summary Improper Authorization vulnerability in nerves-hub nerves\hub\web allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices...

CVE-2026-28806 Improper authorization in device bulk actions and device update API allows cross-organization device control

Improper Authorization vulnerability in nerves-hub nerveshubweb allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to...

CVE-2026-3854 Remote code execution via git push option injection in GitHub Enterprise Server

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly...

CVE-2026-28806: Improper Authorization

Improper Authorization vulnerability in nerves-hub nerveshubweb allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to...

PT-2026-24471

Name of the Vulnerable Software and Affected Versions nerves-hub nerves hub web versions 1.0.0 through 2.3.9 Description An improper authorization issue exists in nerves-hub nerves hub web that allows cross-organization device control through device bulk actions and the device update API. Missing...

CVE-2026-28678

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens JWTs were stored in HTTP cookies without cryptographic protection...

CVE-2026-28678

Further research determined the issue is not a vulnerability...

CVE-2026-28678

...

CVE-2026-28678

CVE-2026-28678 pertains to the DSA Study Hub application. Prior to commit d527fba, the authentication system in server/routes/auth.js stored JWTs in HTTP cookies without cryptographic protection of the payload, exposing credential data via insufficiently protected credentials. The issue affects t...

CVE-2026-28678 dsa-hub-server: Clear-Text Storage of Sensitive Data

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens JWTs were stored in HTTP cookies without cryptographic protection...

EUVD-2026-10157

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens JWTs were stored in HTTP cookies without cryptographic protection...

DSA Study Hub 安全漏洞

DSA Study Hub is an interactive data structure and algorithm learning platform developed by toxicbishop, a personal developer. Previous versions of DSA Study Hub d527fba had security vulnerabilities. These vulnerabilities stemmed from the fact that authentication tokens were stored in HTTP cookie...

PT-2026-23866

Name of the Vulnerable Software and Affected Versions DSA Study Hub versions prior to commit d527fba Description The user authentication system in the application’s server/routes/auth.js component had a flaw related to insufficiently protected credentials. Authentication tokens, specifically JWTs...

Incomplete List of Disallowed Inputs

Overview sagemaker-core is an An python package for sagemaker core functionalities Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the searchhub function. An attacker can execute arbitrary commands, access sensitive data, or compromise the execution...

PT-2026-25577

Summary This advisory addresses the use of the search hub function within the SageMaker Python SDK's JumpStart search functionality. An actor with the ability to control query parameters passed to the search hub function could potentially provide malformed input that causes the eval function to...

Moderate: Red Hat Security Advisory: Red Hat Developer Hub 1.9.0 release.

Red Hat Developer Hub 1.9.0 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

Telegram Increasingly Used to Sell Access, Malware and Stolen Logs

Cybercriminals are now increasingly using Telegram to sell corporate access, malware subscriptions, and stealer logs, turning the messaging app into a fast cybercrime hub...