CVE-2026-66013: Authorization Bypass Through User-Controlled Key

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

GHSA-V6W6-358X-2433 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Summary Cloudreve exposes two admin node test endpoints under the Admin.Read OAuth scope. These endpoints accept attacker-controlled node definitions and cause Cloudreve to make outbound server-side network requests. This allows an OAuth client authorized only for Admin.Read to trigger operationa...

GHSA-PVCR-8MVP-W8QR Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

Summary The Budibase AI chat-link handoff flow GET/POST /api/chat-links/:instance/:token/handoff binds an external chat identity Slack/Discord/MS Teams/Telegram to a Budibase user account. The confirmation endpoint is on a public route no CSRF middleware, no auth-group gate and the only credentia...

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the automation test results broadcast process. An attacker can obtain sensitive OAuth2 access and refresh tokens belonging to other users by passively listening to...

GHSA-GH4H-34GR-87R7 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

GHSA-FCRW-F7GG-6G9F Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Summary The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users OIDC, Google, the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...

MAL-2026-11050 Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

GO-2026-5885 Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go...

EUVD-2026-42625

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout...

GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

...

PT-2026-67600

Summary The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users OIDC, Google, the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity...

PT-2026-64446

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description Cloudreve fails to properly validate WOPI access tokens and enforce requested viewer actions. The system generates tokens in the format ., but the middleware.ViewerSessionValidation function only...

CVE-2026-47669 DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

GO-2026-5987 Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token...

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Summary The exported getToken helper next-auth/jwt and @auth/core/jwt can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken URL-decodes the bearer value before validating it, and malformed percent-encoding causes the...