CVE-2026-67614

CVE-2026-67614 affects CyberPanel prior to 3.0.0. A hard-coded JWT secret in the WebTerminal FastAPI SSH service allows unauthenticated remote attackers to forge valid tokens and obtain an interactive root shell via WebSocket on port 8888. An attacker can craft a forged JWT signed with the hardco...

CVE-2026-67614 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...

CVE-2026-58431

The Gitea application (specifically version 1.26.2 and nightly builds) contains a vulnerability where public-only API token restrictions are not properly enforced on team API routes. The root cause is that the /api/v1/teams/{teamid} route group fails to load ctx.Org.Organization, causing the chec...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

EUVD-2026-58145

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

EUVD-2026-58141

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

EUVD-2026-58132

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2024-3379

creationtimestamp| type| source ---|---|--- 2026-08-13 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msxzmn3vid2f...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Overview Affected versions of this package are vulnerable to Improper Enforcement of Message Integrity During Transmission in a Communication Channel via the negotiation process between GSSAPI and TLS encryption. An attacker can bypass intended authentication and encryption requirements by...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the authentication process. An attacker can determine whether a specific user exists by observing differences in the SCRAM authentication challenge when the targeted user has a non-default scramiterations value...

EUVD-2026-58074

In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...

CVE-2026-6387

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-49820

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...