CVE-2026-86190 WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

CVE-2026-86190 WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

EUVD-2026-71949

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

PT-2026-86415

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description Broken access control in the 'videoViewsInfo' endpoint allows unauthenticated callers to retrieve complete user records when a hash parameter is provided. The exposed data includes password...

CVE-2026-86190: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

CVE-2026-53603

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

EUVD-2026-71716

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

GHSA-7J5W-7R7X-9V27 CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CVE-2026-79418

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

CVE-2026-19274

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 contains a vulnerability in the Instana Agent Operator where cluster-scoped RBAC objects are keyed solely by the bare Custom Resource name with no namespace disambiguation. An authenticated Kubernetes tenant can exploit this by ...

EUVD-2026-71273

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19274 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19274 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-77818

CVE-2026-77818 is a reflected HTML injection vulnerability in Yordam Informatics' Library Information and Document Automation Program (affects versions from v22.1 before v22.2 ), exploitable via form hijacking during web page generation. The vulnerability allows content spoofing and is rated CVSS...