91738 matches found
CVE-2026-46437: Improper Authentication
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...
CVE-2026-76274: Server-Side Request Forgery (SSRF)
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...
CVE-2026-76286: Server-Side Request Forgery (SSRF)
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...
Keycloak 26.7.3 <= 26.8.0 User Session Note Mapper Access Token Exposure (CVE-2026-105302)
The version of Keycloak installed on the remote host is 26.7.3 through 26.8.0. It is, therefore, affected by a vulnerability where a User Session Note protocol mapper can expose upstream identity provider access tokens to managed clients, allowing a client to obtain a token it was not intended to...
PT-2026-107579
Name of the Vulnerable Software and Affected Versions Apache Jackrabbit versions 2.23.0 through 2.23.5 Apache Jackrabbit versions 2.22.0 through 2.22.4 Apache Jackrabbit versions 2.20.0 through 2.20.17 Description The WebDAV server allows session fixation and session reuse across users. The syste...
CVE-2026-92414: Session Fixation
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
PT-2026-107383
A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...
PT-2026-107494
Name of the Vulnerable Software and Affected Versions Express Gateway versions prior to 1.16.12 Description An authentication bypass exists in the OAuth 2.0 refresh token grant. The system fails to validate the token secret or the issuing client. An attacker possessing valid client credentials an...
PT-2026-107394
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...
CVE-2026-103869: Exposure of Data Element to Wrong Session
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...
Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Ubuntu Pro for WSL vulnerability (USN-8892-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8892-1 advisory. Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription o...
Keycloak 26.4.0 <= 26.8.0 Token Introspection Audience Bypass (CVE-2026-105306)
The version of Keycloak installed on the remote host is 26.4.0 through 26.8.0. It is, therefore, affected by a token introspection audience bypass vulnerability. An attacker able to use dynamic client registration can register a client that passes token introspection for tokens that were not issu...
CVE-2026-101023
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the "refreshtoken" grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
EUVD-2026-94061
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...