Debian dla-4787 : ruby-jwt - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4787 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4787-1 [email protected] https://www.debian.org/lts/security/...

PT-2026-96121

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2 Description The Core API logout endpoint only revokes session tokens provided via the token cookie. If a client uses an Authorization bearer header for authentication during logout, the endpoint returns a...

PT-2026-96120

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.3.0 through 3.3.1 Description An issue exists in the Airflow core API where the system incorrectly prioritizes a session cookie over an explicit Authorization: Bearer token when both are present in a request. This...

CVE-2026-86473: Insufficient Session Expiration

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

TokRun 1.0

TokRun is a local Windows token-based process launcher for authorized administration, lab, and red-team environments. It enumerates accessible process tokens on the host, selects a token by user name or PID, duplicates it as a primary token, and launches either a visible cmd.exe shell or a target...

PT-2026-96048

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the User-Managed Access UMA implementation. The issue occurs at the authorization token endpoint when processing permission tickets. If two different users own resources wit...

PT-2026-96274

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description The GET '/api/login with code/:id' endpoint fails to apply the limiterLoginBruteForce mechanism when processing nine-digit SSO authentication codes. This allows an unauthenticated attacker to...

PT-2026-96240

Name of the Vulnerable Software and Affected Versions Sync-in Server versions prior to 2.4.0 Description An issue exists where the POST /api/auth/token endpoint authenticates users using only a username and password, subsequently calling the getTokens function to return full access and refresh JS...

Linux Distros Unpatched Vulnerability : CVE-2026-92745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat...

Linux Distros Unpatched Vulnerability : CVE-2026-93565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming...

CVE-2026-58269: Authentication Bypass Using an Alternate Path or Channel

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...

CVE-2026-91164: Improper Access Control

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-94217: Missing Authorization

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

CVE-2024-11680

ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

CVE-2026-94107 NivoCart through 2.4.0 Predictable Administrator Password Reset Token

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

CVE-2026-94107 NivoCart through 2.4.0 Predictable Administrator Password Reset Token

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

EUVD-2026-83727

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint. Recovery codes are generated using substr(md5(mt_rand()), 0, 10), producing a short and predictable token. An attacker who knows an administrator's email address can request a password ...

CVE-2026-87840

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...