CVE-2026-18255 Quay: quay: global read-only superuser can view robot account tokens

A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...

CVE-2026-18255

A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...

CVE-2026-18255

CVE-2026-18255 is a vulnerability in Quay where a user in the GLOBAL_READONLY_SUPER_USERS group can view robot account tokens for repositories they are not a member of, enabling impersonation of robot accounts. Affected component: Quay’s handling of robot account tokens; root cause: token visibil...

CVE-2026-18255 Quay: quay: global read-only superuser can view robot account tokens

A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...

CVE-2026-18255

A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account. Mitigation Remove users who can not be trusted with...

GHSA-7C26-995W-6F47 veraPDF Parser DoS via PostScript Type 1 Font Programs

Summary Description A PostScript-interpreter-driven Denial of Service CWE-1325 vulnerability in veraPDF allows a remote attacker to exhaust validator memory or CPU by submitting a PDF whose Type 1 font /FontFile is a font program containing attacker-supplied PostScript. veraPDF's Type 1 font...

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

CVE-2026-54660

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-66400

Grav Login Plugin = 3.8.13 or follow vendor advisories cited in the references to mitigate.

Improper Verification of Cryptographic Signature

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verifysignature parameter in the Azure AD OAuth login defaulting to False,...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

EUVD-2026-50216

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-9720

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

EUVD-2026-50199

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

CVE-2026-63229

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-63231 Post-authentication SQL injection vulnerability

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63231

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

EUVD-2026-50126

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

EUVD-2026-50125

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...