GHSA-9XHM-W3WJ-XHQH Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

EUVD-2026-84011

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for...

GHSA-456H-WW26-F758 Tinyauth: User enumeration attack by timing oracle

Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins. PoC Setup a tinyauth server with a local user. It can be over the network. Try to log in with the local user, using ...

Tinyauth: User enumeration attack by timing oracle

Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins. PoC Setup a tinyauth server with a local user. It can be over the network. Try to log in with the local user, using ...

EUVD-2026-84014

Tinyauth: User enumeration attack by timing oracle...

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

Summary The OAuth token fallback file storage in OAuthConfig.savetokenstofile creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obtain...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

The Mattermost server is vulnerable to a denial of service because it fails to enforce a request body size limit during CSRF validation of plugin requests. This flaw allows an authenticated user to exhaust server memory by sending a large request body to a plugin endpoint. Affected versions inclu...

GHSA-G26X-M427-F48F Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Summary The GET /api/v1/stable/durable-tasks/durable-task endpoint listDurableEventLog is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant. Impact This CVE requires the attacker to successfully guess the target UUID. Any...

GHSA-89VX-JH4Q-VG3W deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Summary The RECORDACTION.PATCHMULTI action is not registered in the Valve permission system's RULESMAP src/services/permission/valve/rules-map.ts. When ConfigPermission.canPerformAction is called for a PATCHMULTI message, getRulesForMessage returns null because the action is missing from the map...

CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-75745

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-75686

Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim...

CVE-2026-19480

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-57149 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...