CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48076

OpenReception’s bootstrap booking flow (versions ≤1.0.1) is vulnerable to an unauthenticated booking against private channels due to a missing channel binding in the booking token. The 3-step flow: bootstrap-challenge (PoW), bootstrap-verify (issues a booking access token), and create-new-client ...

CVE-2026-70559 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-70558

Dinky CVE-2026-70558 affects the v1.2.5 release and development branch. The vulnerable component is the POST /download/uploadFromRsByLocal handler, which passes a caller-supplied path directly to new File(path) and file.transferTo(dest) with no path validation. The route is SaIgnore’d and /downlo...

CVE-2026-45414

Decidim CVE-2026-45414 describes a JWT binding flaw in multi-tenant deployments: a JWT issued for one organization can be replayed against another organization’s API to read participantDetails and access the proposal.answer mutation. Affected are pre-0.31.5 and 0.32.0.rc1 before 0.32.0.rc2; the i...

CVE-2026-45414 Decidim: JWT-backed authentication can be replayed across organizations

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2026-64652

The CVE covers GitHub CLI (gh) prior to v2.97.0, where gh auth status could reveal part of certain tokens in output. Affected tokens include fine-grained PATs (github_pat_) and GitHub App tokens (ghs_ and ghu_*), plus the Actions GITHUB_TOKEN, whenever the token format contains an underscore afte...

CVE-2025-12317

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2025-12317 Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...

CVE-2026-14842

The CVE-2026-14842 entry concerns the Events Made Easy WordPress plugin prior to version 3.1.2. The root cause is that the payment authorization token is not bound to the specific payment record being charged, enabling an unauthenticated attacker to pay a lower amount for a cheap booking while a ...

CVE-2026-14842 Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-5423

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423

The CVE affects @neo4j/graphql library prior to 7.5.6 (and 7.5.x) where a pre-decoded JWT passed via GraphQL subscription connectionParams is not verified, allowing unauthenticated clients to forge JWT claims and trigger @authentication/@subscriptionsAuthorization checks to receive restricted sub...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

EUVD-2026-54094

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

EUVD-2026-53936

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...