16203 matches found
CVE-2026-70482
Open WebUI (self-hosted AI platform) versions 0.8.0–0.11.0 are affected. When ENABLE_OAUTH_TOKEN_EXCHANGE is true, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it via the provider’s userinfo endpoint without confirming which OAuth client issued the token. As ...
CVE-2026-0163
creationtimestamp| type| source ---|---|--- 2026-08-04 19:21:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117038861597097181 2026-08-04 21:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwhpxgff2u...
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28481 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...
CVE-2026-8508
creationtimestamp| type| source ---|---|--- 2026-08-04 09:56:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117036637521846673...
CVE-2026-15958
creationtimestamp| type| source ---|---|--- 2026-08-04 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117036064825025921 2026-08-04 19:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpnktkd32f...
CVE-2026-18738
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...
EUVD-2026-52439
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...
CVE-2026-18654
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...
CVE-2026-20465
creationtimestamp| type| source ---|---|--- 2026-08-03 15:46:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117032354304920286...
CVE-2026-20464
creationtimestamp| type| source ---|---|--- 2026-08-03 15:33:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117032302879027594...
CVE-2026-9593
creationtimestamp| type| source ---|---|--- 2026-08-03 06:30:53+00:00| seen| https://infosec.exchange/users/certvde/statuses/117030168375818784...
CVE-2026-8763
creationtimestamp| type| source ---|---|--- 2026-08-03 06:00:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/117030049213840403 2026-08-03 06:00:38+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms5t2wluuw2j 2026-08-03 20:58:03+00:00| seen|...
Microsoft Exchange Server - Cross-Site Scripting
Microsoft Exchange Server, or OWA, is vulnerable to a cross-site scripting vulnerability in refurl parameter of frowny.asp. id: CVE-2021-31195 info: name: Microsoft Exchange Server - Cross-Site Scripting author: infosecsanyam severity: medium description: Microsoft Exchange Server, or OWA, is...
Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter. id: CVE-2008-1547 info: name:...
CVE-2026-59650
Bouncy Castle for Java up to 1.84 (and Java LTS up to 2.73.11) is affected by CVE-2026-59650: MTI/A0 DH key exchange exponentiates an unvalidated peer value. This can impact confidentiality and integrity as described in the CVE, with overall severity listed as CRITICAL (CVSS 9.3). The issue is fi...
CVE-2026-67336
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
EUVD-2026-51816
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
CVE-2026-67335 better-auth before 1.6.2 OAuth State Validation Bypass
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...
EUVD-2026-51852
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...