CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

CVE-2026-42707 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

EUVD-2026-112813

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

CVE-2026-42707

The HivePress Claim Listings WordPress plugin, versions 1.1.4 and below , contains a Broken Access Control vulnerability (CWE-862 ). The issue stems from Missing Authorization , specifically allowing for the exploitation of Incorrectly Configured Access Control Security Levels within the hivepres...

CVE-2026-42707 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin HivePress Claim Listings versions = 1.1.4...

CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-117627

A vulnerability exists in the keycloak-services component's JWT Authorization Grant implementation. When OIDC or Google identity providers are configured with specific login restrictions, such as claim filtering , these checks are bypassed during the JWT-based grant flow, although they are correc...

CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-117627 Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

EUVD-2026-112636

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-116684

A flaw was found in the Model Context Protocol MCP Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side...

Filelock: StrictSoftFileLock Creates Its Claim Directories Without The Lock Mode, So Another Local User With A Write Bit

"StrictSoftFileLock" and "AsyncStrictSoftFileLock" apply the caller's "mode" to the sentinel the lock file at "" and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, ".filelock" and ".filelock/claims", with ...

WordPress HivePress Claim Listings authorization issue vulnerability

WordPress HivePress Claim Listings versions 1.1.4 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, enabling exploitation of improperly configured access control levels...

CVE-2026-117627: Red Hat: A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

PT-2026-132399

Name of the Vulnerable Software and Affected Versions @sd-jwt/core versions prior to 0.20.0 @sd-jwt/decode versions prior to 0.20.0 Description In the @sd-jwt/decode component, also utilized by @sd-jwt/core, the system silently drops tampered Disclosures if their digest does not match the...

CVE-2026-62374: openwallet-foundation: SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

PT-2026-132134

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

PT-2026-130664

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...