EUVD-2026-105141

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

EUVD-2026-105138

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30...

EUVD-2026-105131

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

EUVD-2026-105130

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764

The A2A Java SDK (versions prior to 1.3.0.Final ) contains a fail-open default task authorization vulnerability. The InMemoryTaskStore component's no-argument constructor sets the authorizationProvider to null, causing the get(String taskId) method to return tasks without verifying the caller or ...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

EUVD-2026-105041

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

CVE-2026-25197

CVE-2026-25197: Authorization Bypass via User-Controlled Key IDOR Advisory Field| Value ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Authorization Bypass Through User-Controlled Key Researcher|...

linux-kernel-codex-harness-v2

Kernel Codex Harness v2 한국어 | English Research Tool · Original Import: 3 April 2026 · v2 Documentation Revision: 11 July 2026 External Signal: From Attention Allocation to Provenance-Aware Triage Use reproducible observations to guide model attention, then use repository provenance to organize...

joomla-menu-items-api

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · joomla-menu-items-api joomla-menu-items-api Class: Privilege leftover Reach: Remote Joomla CMS 6.1.3 0f2d4de - Open Source Matters The administrator UI for menu items checks commenus.menu.id and refuses menutype ==...

CVE-2026-113411 Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

EUVD-2026-105022

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

CVE-2026-113411

A vulnerability exists in Nerimity Desktop up to version 2.2.2 within the Window Open Handler component. Specifically, the shell.openExternal function in src/mainWindow.js fails to properly authorize custom URL schemes when the url argument is manipulated. This flaw allows for remote execution of...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

cve-2026-41940-tool

🚀 CVE-2026-41940 – cPanel & WHM / WP Squared Auth Bypass Exploitation Tool A comprehensive Python utility to detect , scan in bulk , and exploit the critical authentication bypass vulnerability CVE-2026-41940 in cPanel & WHM and WP Squared. The tool combines multi‑port smart scanning,...

CVE-2026-54121

🛡️ CVE-2026-54121 — Certighost CTI Investigation Active Directory Certificate Services Privilege Escalation / Domain Compromise Risk Created by Pratik Chhetri Report Date: 2026-07-28 📌 Executive Snapshot Field| Finding ---|--- CVE| CVE-2026-54121 Name| Certighost Vendor| Microsoft Component| Activ...

CVE-2025-29927

Next.js Middleware Authorization Bypass Vulnerability Test Environment CVE-2025-29927 📌 Project Overview This repository provides a local environment for testing the Next.js middleware authorization bypass vulnerability CVE-2025-29927. This vulnerability allows attackers to bypass middleware...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...