CVE-2026-71459

The Red Hat Ansible Automation Platform (automation-controller ) is vulnerable to a cross-tenant job event data exposure due to a missing RBAC check in the JobJobEventsChildrenSummary view. The underlying cause is that the view lacks a model/parent_model definition, causing ModelAccessPermission....

CVE-2026-71459 Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-71459

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

linhub (0.1.1), octo-drf (>=3.0.0, <=4.4.1) potentially affected by CVE-2026-16216 via django-jet (1.0.8)

django-jet PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django-jet and may be impacted: - linhub 0.1.1 - octo-drf =3.0.0, =4.4.1 Source cves: CVE-2026-16216 Source advisory: SNYK:PYTHON-DJANGOJET-18017927...

linhub (0.1.1), octo-drf (>=3.0.0, <=4.4.1) potentially affected by CVE-2026-16215 via django-jet (1.0.8)

django-jet PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django-jet and may be impacted: - linhub 0.1.1 - octo-drf =3.0.0, =4.4.1 Source cves: CVE-2026-16215 Source advisory: SNYK:PYTHON-DJANGOJET-18017926...

CVE-2026-41519: Insufficient Session Expiration

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cyclesessionkeys", but DRF API tokens "wlu" prefix stored in "authtokentoken" are not revoked. This issue has been patched in version 5.17.1...

EUVD-2020-0074

Malware in sbrugna...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

Design/Logic Flaw

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

PYSEC-2020-40

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

PYSEC-2020-40

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

CVE-2020-10594

CVE-2020-10594 affects drf-jwt 1.15.x before 1.15.1. The issue stems from an incompatibility between the blacklist protection mechanism and the token-refresh feature, allowing an attacker who has access to a notionally invalidated token to obtain a new, valid token via the refresh endpoint. The d...

CVE-2020-10594: Improper Authentication

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

drf.com XSS vulnerability

Vulnerable URL: http://www.drf.com/search/%22;alert%22OPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 06.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 58432 VIP website status:| No Coordinated Disclosure Timeline:...

Authentication flaw

The Disaster Recovery Framework DRF master server in Cisco Unified Communications products, including Unified Communications Manager CUCM 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the...

CVE-2008-1154

The Disaster Recovery Framework DRF master server in Cisco Unified Communications products, including Unified Communications Manager CUCM 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the...

CVE-2008-1154

The CVE-2008-1154 issue affects Cisco Unified Communications products featuring Disaster Recovery Framework (DRF). The DRF Master server accepts network requests without authentication, allowing a remote, unauthenticated attacker to perform DRF tasks and, per the sources, potentially execute arbi...