CVE-2026-45129

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-75485 Must-gather: /tmp/kubeconfig retention

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485 Must-gather: /tmp/kubeconfig retention

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

In Red Hat Advanced Cluster Management for Kubernetes, the must-gather component dumps the cluster Proxy object raw, bypassing oc inspect redaction and exposing proxy basic-auth credentials in the archive. CVSS 5.5 (MEDIUM), local exploit, no in-the-wild exploitation reported. Monitor Red Hat adv...

EUVD-2026-60959

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

GO-2026-6123 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server...

GO-2026-6117 Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend...

ANT-2026-96NHD13X · supabase/auth · auth-bypass

auth-bypass low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-96NHD13X: Factor-type string mismatch prevents session AAL downgrade In supabase/auth, DowngradeSessionsToAAL...

ANT-2026-CGR7Y3J8 · supabase/auth · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CGR7Y3J8: OAuth authorization code single-use not enforced atomically In the authorizationcode grant handler of the...

ANT-2026-XJKJSANG · supabase/auth · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XJKJSANG: Azure issuer check uses always-true boolean expression In the Azure external auth provider azure.go:72, t...

ANT-2026-0JJXMV3G · supabase/auth · privilege-escalation

privilege-escalation medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-0JJXMV3G: Passkey registration requires no step-up authentication The POST...

ANT-2026-7WJV60DR · supabase/auth · other

other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7WJV60DR: Manual identity linking enables account takeover via unverified email When...

ANT-2026-BVDWY3J9 · supabase/auth · open-redirect

open-redirect medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-BVDWY3J9: Redirect allow-list ignores URL scheme and port In supabase/auth, IsRedirectURLValid...

ANT-2026-GQ8G77M4 · supabase/auth · broken-access-control

broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-GQ8G77M4: Banned users retain authenticated endpoint access maybeLoadUserOrSession in...

ANT-2026-CT4ZXP4Z · supabase/auth · privilege-escalation

privilege-escalation medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CT4ZXP4Z: Parent refresh token of post-MFA token yields AAL2 without MFA In supabase/auth's...