CVE-2026-111490

The MatchPoint API is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the API relies on the actingasuser HTTP header without properly verifying if the requester is authorized to act as the specified user. By manipulating sequential identifiers, an a...

CVE-2026-85298

A flaw was found in Google Cloud Application Integration. An improper authorization flaw in the authentication configuration AuthConfig validation and integration execution runtime allows an authenticated user to escalate privileges. By exploiting this vulnerability, an attacker can impersonate a...

CVE-2026-110863

A flaw was found in @better-auth/sso. An authenticated attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to other user accounts by registering a custom Single Sign-On SSO provider. Because the application ignores the provider identifier during account...

CVE-2026-38601

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies...

CVE-2026-38601

The codeskyblue gohttpserver (through version v1.3.0 ) contains a hardcoded session secret key . This vulnerability allows an attacker to forge session cookies, leading to the ability to impersonate any user , bypass OpenID Connect authentication , and gain access to all controls. No specific rem...

CVE-2026-105765

A flaw was found in HashiCorp Consul. An authorization bypass vulnerability in the agent's service mesh leaf certificate API allows an attacker without a valid Access Control List ACL token to retrieve cached service leaf certificates along with their private keys. This could enable an unauthoriz...

impersonate-rs

IRS Impersonate-RS 💡 IRS is a library version of https://github.com/zblurx/impersonate-rs, zblurx Reimplementation of Defte Impersonate in plain Rust. For more informations about it, see this blogpost. The token impersonation approach is a bit different from Defte Impersonate : here you have to...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

CVE-2026-119148

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6...

CVE-2026-107938

A flaw was found in Apache CXF's Netty-based HTTP client transport. This flaw enables information disclosure because the client fails to verify that the server's identity matches the host name in the Transport Layer Security TLS certificate. A network attacker capable of intercepting traffic coul...

WordPress Rich Showcase for Google Reviews authorization issue vulnerability

WordPress Rich Showcase for Google Reviews versions 7.1.6 and earlier contain an authorization issue vulnerability. This flaw arises because the plugin fails to properly verify whether a user has the necessary permissions to perform certain actions. As a result, authenticated attackers with...

CVE-2026-111460

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potential...

CVE-2026-111460 Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potential...

CVE-2026-111460 Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potential...

CVE-2026-111460

The OnCell G3150A-LTE Series is affected by a hard-coded cryptographic key vulnerability (CWE-321). An unauthenticated remote attacker could potentially obtain shared cryptographic key material under certain conditions. This could allow the attacker to impersonate affected devices that have not r...

EUVD-2026-110618

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potential...

PT-2026-125886

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potential...

Moxa OnCell G3150A-LTE Series encryption issue vulnerability

The Moxa OnCell G3150A-LTE Series version 1.0.0 contains an encryption vulnerability. This vulnerability stems from the presence of a hard-coded encryption key; unauthenticated remote attackers can obtain this shared encryption key material and impersonate affected devices that have not...

BenoitC Hackney encryption issue vulnerability

Versions 1.24.0 through 4.9.0 of benoitc hackney contain an encryption vulnerability stemming from improper certificate validation. hackneyssl adds a partialchain callback to each verifypeer configuration; it uses the public key matching the bundled certifi store root certificate as a trust ancho...

Apache Vysper authorization issue vulnerability

Apache Vysper has an authorization issue vulnerability stemming from a lack of authentication checks in its XEP-0077 inbound registration implementation. This may lead to authorization bypass, allowing any authenticated user to impersonate another account...