91160 matches found
CVE-2026-63493
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...
GHSA-HXCX-9H4F-42XX Snipe-IT: 2FA bypass via the API token flow
Impact An attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user read and write across the user's permissions, including admin if the victim is an admin. The token is an API credential, not a web/UI session using it...
Snipe-IT: 2FA bypass via the API token flow
Impact An attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user read and write across the user's permissions, including admin if the victim is an admin. The token is an API credential, not a web/UI session using it...
Authentication Bypass Using an Alternate Path or Channel
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the API token issuance process. An attacker can gain unauthorized persistent API access by authenticating with a...
CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...
CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...
EUVD-2026-86291
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...
CVE-2026-63493
Prior to version 8.7.0 , Snipe-IT is vulnerable to a 2FA bypass due to inconsistent middleware enforcement. While the web middleware group enforces CheckForTwoFactor, the API middleware group does not. An attacker with a password-authenticated session and self.api permissions can access the perso...
CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...
CVE-2026-63203
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...
CVE-2026-93266 arm64: RSI: fix field-spanning write warning in attestation token init
In the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The challenge is passed in registers a1 through a8. However, copying to ®s.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a...
EUVD-2026-86138
In the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The challenge is passed in registers a1 through a8. However, copying to ®s.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a...
CVE-2026-93266
The Linux kernel on arm64 architecture contains a vulnerability in the RSI attestation token initialization (rsi_attestation_token_init). The root cause is a field-spanning write triggered by FORTIFY when copying a 64-byte challenge into the ®s.a1 field, which is treated as an 8-byte destinati...
CVE-2026-63203
In Logto versions 1.31.0 through 1.42.0 , a vulnerability exists in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. The root cause is that the handlers authenticate users but fail to require the identities scope , allowing callers with only an openid sc...
CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...
EUVD-2026-85920
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...
CVE-2026-97062
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...
CVE-2026-91187
Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...
CVE-2026-97062
Aureus ERP versions up to and including 1.6.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The application allows authenticated users to upload SVG files that are stored on a public disk and served from the application's origin. An attacker can craft a malicious SVG containing scri...
EUVD-2026-85887
Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the...