892 matches found
CVE-2026-110959
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...
EUVD-2026-124272
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...
CVE-2026-110959
The Descope WordPress plugin prior to version 1.2.0 is vulnerable to an unauthenticated account takeover . The root cause is the failure to validate the authentication token received before creating a WordPress session; the plugin accepts any non-empty token. An unauthenticated attacker can explo...
CVE-2026-110959 Descope < 1.2.0 - Unauthenticated Account Takeover
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...
PT-2026-145702
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...
CVE-2026-110959: Unknown Descope: The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a…
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...
CVE-2024-25175
CVE-2024-25175 Reflected XSS via HTTP Response Splitting Description : Exploitation of this vulnerability can lead to the execution of JavaScript code in the victim's browser Cross-Site Scripting when following a specially crafted link. The vulnerability arises because The web server does not...
openclaw-hardening-check
This script only reads. It fixes nothing and does not guarantee that you are safe. Green output means only that the checks listed below passed—and nothing more. OpenClaw hardening check openclaw-hardening-check.mjs is a small, dependency-free, offline review of an OpenClaw installation. It reads...
CVE-2026-25253
CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...
CVE-2026-86044
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an...
CVE-2026-86044
JupyterLab Desktop versions prior to 4.6.2-1 are vulnerable to a vulnerability where the application exposes getServerInfo to the renderer without verifying that the current page maintains the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8 , an attacker can ...
EUVD-2026-118461
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an...
PT-2026-138442
Name of the Vulnerable Software and Affected Versions JupyterLab Desktop versions prior to 4.6.2-1 Description JupyterLab Desktop exposed the getServerInfo function to the renderer without verifying if the current page maintained the local Jupyter server origin. In local managed sessions using...
CVE-2026-123271
A flaw was found in ChatCLI. During the Model Context Protocol MCP Open Authorization OAuth login process, the application does not verify whether server-supplied resource metadata matches the configured server URL. A malicious MCP server can exploit this issue by specifying a different resource...
CVE-2026-117681
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
EUVD-2026-114682
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
CVE-2026-117681 Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
PT-2026-134488
Name of the Vulnerable Software and Affected Versions konflux-ci affected versions not specified Description A flaw in the user interface proxy allows privilege escalation when Transport Layer Security TLS certificate verification is automatically disabled for connections to internal backend...
CVE-2026-117681: A flaw was found in konflux-ci
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
CVE-2026-48164
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...