CVE-2026-126280

NocoDB versions prior to 2026.08.0 are vulnerable to a race condition in the refresh-token rotation process. The flaw exists because UserRefreshToken.ts fails to verify the affected-row count during rotation. This allows an attacker with a captured refresh token to present it concurrently with a ...

EUVD-2026-125241

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid...

CVE-2021-43857

CVE-2021-43857 CVE-2021-43857 Gerapy command execution Disclaimer This script is for learning and reference only. Do not maliciously attack other people's websites. If you violate laws or regulations, all consequences shall be borne by the user. Technology is innocent and has nothing to do with t...

PT-2026-146611

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.0 Description A race condition exists in the refresh-token rotation process. This occurs because the UserRefreshToken.ts file does not verify the affected-row count during the rotation. Consequently, an attacke...

CVE-2018-7935

CVE-2018-7935 POC grab vaild Session first curl http://192.168.8.1/html/index.html | grep SessionID Instructions: Edit exploit.py , insert grabbed SessionID Vulnerability Status : Acknowledgemnt Recieved & Patch is released...

CVE-2026-120978

On affected Arista EOS platforms running Border Gateway Protocol with Link State BGP-LS and configured with the Dynamic Path Selection DPS consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart...

CVE-2026-107244

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

EUVD-2026-120626

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

CVE-2026-107244

The Node.js web service on VOS (formerly Versa FlexVNF) is vulnerable to an authentication bypass. The /decryptTest endpoint in server.js is registered before the session authentication middleware and creates an authenticated session upon successful token decryption. Because the decryption key an...

CVE-2026-107244

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

PT-2026-141239

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

CVE-2026-107244: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

CVE-2026-123282

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session...

EUVD-2026-118047

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session...

CVE-2026-123282

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session...

CVE-2026-123282

JetBrains Datalore versions prior to 2026.4 are affected by a resource management error. The root cause is a missing expiration validation for account tokens, which allows an attacker to establish a new authenticated session . The impact is classified as CRITICAL (CVSS 3.1 score of 9.1) because i...

CVE-2026-123282

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session...

CVE-2026-123282: JetBrains Datalore: In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session...

Malicious code in zhenbaileys (npm)

zhenbaileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/messages-recv.js, lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query and...

PT-2026-121745

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP SECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...