2251 matches found
EUVD-2026-63550
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...
CVE-2026-56654
A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...
CVE-2026-77069
n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...
EUVD-2026-63258
n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...
Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...
EUVD-2026-63103
In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...
CVE-2026-76251
In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...
CVE-2026-76251
Splunk Enterprise versions before 10.0.9, 10.2.6, and 10.4.2 fail to enforce the read_o11y_content capability on the Splunk App for Splunk Observability Cloud REST API endpoints, allowing low-privilege users to forward requests using the stored access token, exposing Observability Cloud data (HIG...
CVE-2026-63408
In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...
CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...
CVE-2026-14287
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...
EUVD-2026-62263
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...
GHSA-6X2C-PHFF-WX57 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...
CVE-2026-64859
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
CVE-2026-64859
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
CVE-2026-64859
In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
PT-2026-76670
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...