Musicbox WordPress - Reflected XSS

contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...

keycloak-services: keycloak-services: Residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-123271

ChatCLI versions prior to v1.215.2 are vulnerable to an improper validation flaw in the MCP OAuth login flow . The application fails to verify that the server-supplied Protected Resource Metadata matches the configured server URL when used as a resource indicator. An attacker operating a maliciou...

EUVD-2026-117724

ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same...

CVE-2026-112208

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...

EUVD-2026-117568

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...

CVE-2026-112208

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...

EUVD-2026-117184

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument userresponse leads to authorization bypass. The attack may be launched...

CVE-2026-122019

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument userresponse leads to authorization bypass. The attack may be launched...

CVE-2026-122019

A vulnerability exists in the Social Login Flow component of 6amTech 6valley 16.0 . Specifically, the existingAccountCheck function within the file /api/v1/auth/existing-account-check is susceptible to manipulation. By altering the user_response argument, an attacker can achieve an authorization ...

PT-2026-137195

Name of the Vulnerable Software and Affected Versions 6amTech 6valley version 16.0 Description An authorization bypass exists in the Social Login Flow component. A remote attacker can manipulate the user response variable within the existingAccountCheck function at the...

CVE-2026-41940-cPanel-WHM-Verification-Tool

CVE-2026-41940 cPanel & WHM Verification Tool This repository contains a Python verification script for CVE-2026-41940, a critical authentication bypass vulnerability disclosed in cPanel & WHM. This project is intended for authorized defensive validation only. It is not intended for exploit...

CVE-2026-114662

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...

CVE-2026-114662

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...

EUVD-2026-107904

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...

PT-2026-120944

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...

Improper Encoding or Escaping of Output

Overview @apostrophecms/form is a Build forms for ApostropheCMS in a simple user interface. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via insufficient enforcement of hCaptcha verification in the login flow, allowing an authenticated low-privileged...

Cross-site Request Forgery (CSRF)

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the AWS auth manager SAML login flow, where login discards the AuthnRequest id...

Use of GET Request Method With Sensitive Query Strings

Overview auth0-lock is a plugin for Auth0. Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via the Active Directory login flow in the auth0-lock enterprise authentication components. An attacker can expose the user's Active Directory...

Use of GET Request Method With Sensitive Query Strings

Overview org.webjars.npm:auth0-lock is a WebJar for auth0-lock. Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via the Active Directory login flow in the auth0-lock enterprise authentication components. An attacker can expose the user's...