246 matches found
EUVD-2026-65904
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...
CVE-2026-79122
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...
CVE-2026-79122
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...
CVE-2026-79122
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...
CVE-2026-79122
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...
PT-2026-81702
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak exists in the SignIn function that allows a remote attacker to obtain sensitive information by sending crafted network traffic. Recommendations Update Google Chrome ...
CVE-2026-79122: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...
CVE-2026-51584
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...
CVE-2026-51584
A remote attacker can achieve account takeover in usememos v0.27.1 due to an improper authentication flaw in the SignIn handler (located at server/router/api/v1/auth_service.go). The vulnerability exists because the ssoCredentials branch matches SSO identity based on an attacker-controllable iden...
PT-2026-70209
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject...
EUVD-2026-56175
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...
CVE-2026-51584
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...
CVE-2026-51584
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...
CVE-2026-51584
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...
EUVD-2026-39022
Ghost: Member existence leak via magic link sign-in response...
GHSA-CHGM-3698-JM42 Ghost: Member existence leak via magic link sign-in response
Impact A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.18.0 up to v6.21.0...
CVE-2026-55502
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...
CVE-2026-55502 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...
CVE-2026-55502 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...
EUVD-2026-51394
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...