PT-2026-83630

Name of the Vulnerable Software and Affected Versions ash graphql versions 1.4.0 through 1.10.9 Description An incorrect authorization issue exists in the subscription resolver within AshGraphql.Graphql.Resolver. This allows an authenticated subscriber in one tenant to receive records belonging t...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...

PT-2026-83583

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12 Description The software fails to enforce login-only module restrictions within the RSS feed endpoints for the forum and announcements modules. This allows unauthenticated attackers to retrieve forum topics and...

Linux Distros Unpatched Vulnerability : CVE-2026-82469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh toke...

Incorrect Authorization

Overview org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. Affected versions of this package are vulnerable to Incorrect Authorization in the...

CVE-2026-82461

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82462

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

CVE-2026-82460

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory...

CVE-2026-82469

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

CVE-2026-82469

Rodauth before 2.47.0 contains an authentication bypass in its jwt_refresh route. The route issues new JWT access tokens without requiring a valid refresh token; an attacker who holds a temporary access token can present it via a non-POST method to obtain a new valid token, enabling indefinite ac...

EUVD-2026-68126

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

CVE-2026-82469 Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

CVE-2026-82462

pac4j-oidc versions prior to 6.5.6 contain an authentication bypass vulnerability in the OIDC callback handling. The OidcCredentialsExtractor accepts callbacks carrying only an access token without requiring an authorization code or ID token, allowing attackers to substitute access tokens minted ...

CVE-2026-82462 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

EUVD-2026-68119

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

CVE-2026-82461

pac4j-oidc versions before 6.5.6 fail to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles via the KeycloakRolesAuthorizationGenerator component. Attackers with low privileges can forge access tokens containing administrative roles paire...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

EUVD-2026-68118

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82452

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...