68 matches found
CVE-2026-19127 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...
CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...
CVE-2026-57818
The vulnerability CVE-2026-57818 affects the JCacheCodeDataProvider used in Apache CXF’s OAuth2 implementation. A TOCTOU race condition allows an attacker to redeem a single authorization code multiple times through concurrent requests, causing issuance of multiple distinct, valid access tokens. ...
CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...
CVE-2026-68079
Apache CXF’s DefaultEncryptingCodeDataProvider has a flaw in removeCodeGrant that allows an authorization code to be redeemed unlimited times, violating the one-time-use RFC requirement. This can enable unlimited replay of captured codes. Affected versions are fixed in CXF 4.2.3, 4.1.8, and 3.6.1...
CVE-2026-49319 Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack
Remote Keyless Entry System RKES, using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a...
CVE-2026-32987
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admi...
CVE-2026-32987 OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admi...
CVE-2025-67135
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack...
CVE-2025-67135
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack...
CVE-2025-67135
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack...
CVE-2025-67135
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack...
CVE-2025-67135
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack...
CVE-2025-67135
CVE-2025-67135 affects PGST PG107 Alarm System 1.25.05.hf via the PF-50 1.2 keyfob. The root cause is weak security in the keyfob enabling code replay attacks that compromise access control. Exploitation is not described in the provided documents; CVSSv3.1 indicates a critical impact (AV:N/AC:L/P...
PT-2026-7741
Name of the Vulnerable Software and Affected Versions PGST PG107 Alarm System version 1.25.05.hf PF-50 keyfob version 1.2 Description A security weakness exists in the PF-50 1.2 keyfob used with the PGST PG107 Alarm System version 1.25.05.hf. This weakness allows attackers to compromise access...
CVE-2023-31761
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack...
CVE-2023-31762
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack...
EUVD-2023-38608
Malicious code in bioql PyPI...