SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE

This project provides support for using Spring Security with OAuth 1a and OAuth2. It provides features for implementing both consumers and providers of these protocols using standard Spring and Spring Security programming models and configuration idioms. Code of Conduct This project adheres to th...

CVE-2026-101271

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-101271 OAuth credentials not disabled when application is disabled

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-101271

In an unspecified software system, OAuth credentials (access tokens) remain valid for their full lifetime even after the associated OAuth client application has been manually disabled. This behavior allows for potential unauthorized access during the period between application deactivation and to...

EUVD-2026-88754

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-101271 OAuth credentials not disabled when application is disabled

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-5229

CVE-2026-5229 CVE-2026-5229: Form Notify Auth Bypass via LINE OAuth Callback CVSS 9.8 Form Notify — LINE OAuth Authentication Bypass Scanner Plugin: Form Notify form-notify Vulnerability Type: Unauthenticated LINE OAuth Authentication Bypass → Account Takeover CVSS Score: 9.8 Critical CVSS Vector...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86157

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

EUVD-2026-88649

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158

Progress Software Fiddler Everywhere 8.0.2 contains a vulnerability due to missing authentication in its local .NET backend (Fiddler.WebUi ). A local unauthenticated attacker can exploit unauthenticated localhost HTTP and SignalR RPC channels to mint OAuth tokens and read the machine-in-the-middl...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

EUVD-2026-88648

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-86157

Progress Telerik Fiddler Everywhere versions prior to 8.2.0 are vulnerable to the exposure of privileged IPC functionality . A local, low-privileged attacker who can modify application launch parameters and influence a user to start the application can replace the UI or settings with attacker-con...

CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2025-6514

mcp-remote Connect an MCP Client that only supports local stdio servers to a Remote MCP Server, with auth support: Note: this is a working proof-of-concept but should be considered experimental. Why is this necessary? So far, the majority of MCP servers in the wild are installed locally, using th...

oauth-client-exploit

This repository does not have a README...

CVE-2026-102374

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject...

CVE-2026-102374

Versions of GestSup prior to 3.2.62 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the IMAP OAuth connector . The root cause is the double-decoding of MIME-encoded email subjects after HTML escaping has already occurred. This allows unauthenticated attackers to send cr...