92540 matches found
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...
CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...
CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...
EUVD-2026-68118
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...
CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
EUVD-2026-68103
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-19430
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...
CVE-2026-16259
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...
CVE-2026-81026
The MasterStudy LMS WordPress Plugin (versions before 3.7.40 ) is vulnerable to an Unauthenticated Payment Bypass via PayPal IPN. The plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users ...
EUVD-2026-68062
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-19430
The Catfolders Document Gallery Pro WordPress plugin, in versions before 2.0.7 , contains an unauthenticated missing authorization vulnerability. The root cause is that certain REST API routes lack proper authorization, combined with a client-side forgeable token used to identify content. This al...
EUVD-2026-68049
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...
CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...
CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...
CVE-2026-16259 Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...
EUVD-2026-68042
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...
CVE-2026-16259
The Uix UserCenter WordPress plugin (versions through 1.0.3 ) contains an unauthenticated privilege escalation vulnerability. The flaw exists because the plugin fails to verify account ownership during unauthenticated profile-update actions and utilizes a hardcoded signing key that is identical a...
Malicious Package
Overview common-array-token is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-15550 Malicious code in common-array-token (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8dc846e743e9517d8444feb25299ce05d9c6e060a050fdaa1b3b44a8cb5cbd package.json declares scripts.postinstall = 'node index.js'. On npm install, index.js reconstructs a URL from a String.fromCharCode numeric array...