PT-2026-82562

FrontAccounting through 2.4.20 generates a CSRF token in end form in includes/ui/ui controls.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/change current user password.php call check csrf token to validate it. No financial transaction...

PT-2026-82794

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

PT-2026-82844

Name of the Vulnerable Software and Affected Versions WatchGuard Dimension affected versions not specified Description WatchGuard Dimension records unredacted session identifiers for logged-in users within its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log t...

PT-2026-82731

Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...

PT-2026-82791

Name of the Vulnerable Software and Affected Versions Ebyte gateway products affected versions not specified Description Improper protection of authentication tokens in the web management interface occurs during client-side session handling. This flaw allows an attacker who obtains exposed sessio...

CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...

DRUPAL-CONTRIB-2026-112

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036

Stalwart Mail Server through 0.16.19 fails to validate OAuth redirect_uri against registered destinations in its default configuration. The root cause lies in crates/http/src/auth/oauth/registration.rs, where the validation routine returns success immediately because the client-authentication req...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

EUVD-2026-66612

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81034

Netmaker (through v1.6.0 ) unconditionally disables TLS certificate verification on its SMTP connection in pro/email/smtp.go , where the skip-verify field is set to true with no configuration path to override it. An attacker positioned between Netmaker and its mail relay can present a rogue certi...

EUVD-2026-66610

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

EUVD-2026-66605

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-81029 OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-81027

one-api (through version 0.6.10 ) contains an authorization bypass in its channel-pinning logic in middleware/auth.go. The software offers two ways to pin a request to a specific upstream channel: a suffix on the API key and a URL path parameter (channelid). Only the suffix path is gated behind a...

CVE-2026-81027 one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...