CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO Authentication Bypass Executive Summary FortiCloud Single-Sign-On SSO a factory default enabled feature once you register any FortiGate/FortiManager/FortiAnalyzer contains a critical authentication-bypass flaw. An attacker who owns any FortiCloud account free or pa...

CVE-2020-24030

CVE-2020-24030 Description ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and to access sensitive data via token reuse. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

CVE-2026-109231

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the onuseremailchanged hook — which is responsible for rotating the activation token and recording a...

CVE-2026-109231 Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the onuseremailchanged hook — which is responsible for rotating the activation token and recording a...

EUVD-2026-114696

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the onuseremailchanged hook — which is responsible for rotating the activation token and recording a...

CVE-2026-109231

The Germanized for WooCommerce plugin for WordPress (versions

CVE-2026-109231: vendidero Germanized for WooCommerce: The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation…

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the onuseremailchanged hook — which is responsible for rotating the activation token and recording a...

PT-2026-134501

Name of the Vulnerable Software and Affected Versions Germanized for WooCommerce versions prior to 4.1.5 Description An issue exists where authenticated attackers with Subscriber-level access or higher can gain unauthorized access to private data. This occurs when the on user email changed hook...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

CVE-2026-50000

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

EUVD-2026-114255

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

CVE-2026-94386

CVE-2026-94386 — camel-oauth: cross-scope token reuse via an under-keyed JVM-global token cache Runnable proof-of-concept reproducer for the Apache Camel vulnerability where OAuthClientCredentialsTokenResolver kept the client-credentials tokens it obtained in a static cache shared by every resolv...

CVE-2026-50000: freedomofpress securedrop: SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept…

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

EUVD-2026-112639

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...