CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints,...

CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints,...

CVE-2026-123545 OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

CVE-2026-123545

The software OpenAM versions 14.5.1 before 16.1.4 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the OAuth 2.0 device authorization flow . The vulnerability occurs when consent is skipped for implied-consent clients, enabling an attacker to approve device codes without proper au...

CVE-2026-123545 OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

CVE-2026-123545 OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

EUVD-2026-119402

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

CVE-2026-123517 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

CVE-2026-123517

Vikunja versions prior to 2.7.1 are vulnerable to an information disclosure vulnerability via the team member self-removal endpoint. Authenticated users can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team IDs. By analyzing the distinguishable responses, an attacker c...

CVE-2026-123517 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

CVE-2026-123517 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

EUVD-2026-119388

Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling...

CVE-2026-123503

Vikunja versions prior to 2.7.1 are vulnerable to an improper authorization flaw in the canDoBucket function. This vulnerability allows users with project write access to delete buckets by providing a mismatched view ID . By requesting deletion through another view's bucket endpoint, an attacker ...

CVE-2026-123545: OpenIdentityPlatform OpenAM: OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device…

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

PT-2026-139798

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

PT-2026-139902

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs...

PT-2026-139985

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl eob invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-123517: go-vikunja vikunja: Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine…

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

PT-2026-139807

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every...

PT-2026-139826

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...