337 matches found
phonepe-sensitive-data-exposure-cve-2025-5154
-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched- Discovered byhc4 Date Reported: April 2025 CVE Status: CVE Requested Pending CVE Request 1862785 for CVE ID Reques 📌 Overview A critical local vulnerability was discovered in the PhonePe Android app tested on...
GHSA-V3X9-6GG8-C2C9 wger: API credentials remain valid after logout/password change
Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...
CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
EUVD-2026-90542
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
CVE-2026-103651: Concurrent Execution using Shared Resource with Improper Synchronization
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
CVE-2026-34990
CVE-2026-34990 — локальное повышение привилегий в CUPS cups2root, de-harnessed CVSS 3.x : 8.4 HIGH приблизительно — проверьте CWE : CWE-287 Improper Authentication + CWE-269 Improper Privilege Mgmt Fix : CUPS 2.4.17+ Affects : CUPS ≤ 2.4.16 with cupsd running as root and 631 reachable locally...
PYSEC-2026-4188
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
PYSEC-2026-4188
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
EUVD-2026-88696
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930: Insufficiently Protected Credentials
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563
The Zscaler MCP Server versions 0.7.0 and 0.7.1 are vulnerable to a token replay issue. The root cause is that HMAC confirmation tokens are not bound to the target resource identifier. This allows an MCP client or agent to replay a token intended for one resource to impact another resource of the...
EUVD-2026-88244
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563: Authentication Bypass by Primary Weakness
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
EUVD-2026-85048
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...
PT-2026-97185
Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message direct...