CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

PT-2026-96012

Name of the Vulnerable Software and Affected Versions stable-baselines3 versions prior to 2.9.1 Description An issue exists in the save util.py file involving unsafe pickle deserialization. This allows for remote attacks through the PPO.load, load replay buffer, and VecNormalize.load functions...

PT-2026-95968

Name of the Vulnerable Software and Affected Versions mayswind ezBookkeeping versions prior to 2.0.0 Description The software fails to invalidate Time-based One-Time Password TOTP passcodes after they have been used. This allows an attacker who has obtained stolen credentials to replay a captured...

CVE-2026-94112: Authentication Bypass by Capture-replay

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-93982

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

CVE-2026-93982 OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

CVE-2026-93982

OpenPanel (through commit bad75bdd ) writes Model Context Protocol (MCP) authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP...

EUVD-2026-83587

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests...

CVE-2026-93982 OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

CVE-2026-63405

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

Summary The Pusher-compatible REST API includes bodymd5 in the HMAC signature string but never computes or verifies the MD5 of the received HTTP body, allowing anyone who observes a signed request to replay it with an entirely different body. Details In pusher/http.go, the Handler function extrac...

GHSA-5P54-WHVP-X327 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

Summary The Pusher-compatible REST API includes bodymd5 in the HMAC signature string but never computes or verifies the MD5 of the received HTTP body, allowing anyone who observes a signed request to replay it with an entirely different body. Details In pusher/http.go, the Handler function extrac...

CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

EUVD-2026-83180

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

CVE-2026-63405

AnyCable is a realtime server supporting any backend. Prior to 1.6.15 , its Pusher-compatible REST API (in pusher/http.go) includes the caller-supplied body_md5 value in the HMAC signature but never computes or verifies the MD5 of the actual received body. Because there is also no auth_timestamp ...

CVE-2026-54148

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

EUVD-2026-83039

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

CVE-2026-54148 http4k: `DigestAuthProvider.verify` did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...