CVE-2026-90452: Improper Certificate Validation

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-89151: Incorrect Authorization

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

Security update for python-jwcrypto (moderate)

openSUSE security update: security update for python-jwcrypto ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21827-1 Rating: moderate References: bsc1277639 bsc1278707 Cross-References: CVE-2026-80179 CVE-2026-84185 CVSS scores: CVE-2026-80179 SUSE...

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?” An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks usef...

CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication (TOTP) on its API endpoints. Attackers who obtain an administrator's password can derive API tokens from that password and perform administrative operations or create authenticated sessions without the second factor. The vulnerabi...

CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

OPENSUSE-SU-2026:21827-1 Security update for python-jwcrypto

This update for python-jwcrypto fixes the following issues: - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification bsc1278707...

SUSE-SU-2026:23702-1 Security update for python-jwcrypto

This update for python-jwcrypto fixes the following issues: - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification bsc1278707...

EUVD-2026-75322

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

MAL-2026-16122 Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

PT-2026-89328

🚨 HIGH SEVERITY: CVE-2026-88287 CVSS 7.5 GeoVision GV-LPC2211 V1.13 vulnerable to unauthenticated remote DoS via ONVIF WS-Discovery exploit. Stack corruption possible. Affected orgs: patch immediately. CVE Vulnerability PatchNow ThreatIntel https://t.co/3PnGa2XGRC...

PT-2026-89406

🚨 CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or creat...

CVE-2026-88895: Improper Authentication

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-88287: Stack-based Buffer Overflow

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...

CVE-2026-88770: Improper Restriction of Excessive Authentication Attempts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the oauth/personal-access-tokens routes, which are exposed with insufficient middleware protections. An attacker can obtain a long-lived bearer...