UBUNTU-CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97025

The Flatpak application is vulnerable to a local information disclosure flaw where it writes the OCI repository authentication token with world-readable permissions (0644 ) in the system-helper's cache directory. This allows other local users on a multi-user system to read the token and impersona...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

Exploit for Improper Authentication in Openprinting Cups

CVE-2026-34990-POC Technical analysis and proof-of-concept res...

Exploit for Improper Authentication in Openprinting Cups

CVE-2026-34990-POC Technical analysis and proof-of-concept res...

CVE-2026-63208

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-67420

A flaw was found in rabbitmq-server. When an existing Advanced Message Queuing Protocol AMQP connection refreshes its authentication token to one with revoked impersonation privileges, the server fails to update the active session's security tags. As a result, an authenticated user can retain...

PT-2026-99083

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When a Microsoft Graph request fails, the system logs the error including the authentication token used to access the mailbox. Although the system attempts to mask the token, the process is incomplete...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor

Mac security researcher Patrick Wardle says it’s trivial to turn Muse into “the ultimate backdoor.” Increasingly, AI assistants are changing from tools that simply answer questions into agents that can plan tasks, use connected services, and take actions for us. These actions might include bookin...

EUVD-2026-83182

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logrequest function in jupyterserver/log.py, which logs the full Referer header value without sanitization. When a request causes a 500 error, the Referer header - which may conta...

CVE-2026-88795: Improper Control of Generation of Code

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

EUVD-2026-67581

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

EUVD-2026-67283

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...