CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic, related to improper code generation, allows a hacker to trigger a service failure.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns stems from improper handling of code generation. This allows attackers to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns stems from improper handling of code generation. This allows attackers to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns stems from improper handling of code generation. This allows attackers to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the `src/utils/base_encoding.c` file in the ISOBMFF component parser of the GPAC multimedia platform allows a attacker to trigger a service failure.

The vulnerability of the src/utils/baseencoding.c file in the ISOBMFF component parser of the GPAC multimedia platform is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Cisco ASA Improper Access Control (CVE-2018-15398)

A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass an access control list ACL that is configured for an interface of an affected device. The...

Linux Distros Unpatched Vulnerability : CVE-2026-105221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on- path attackers to intercept HTTPS traffic because...

Cisco ASA Improper Input Validation (CVE-2020-3304)

A vulnerability in the web interface of Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is...

CVE-2026-94646

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-85087

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-104974: Improper Access Control

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...

CVE-2026-105223: Improper Certificate Validation

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-58834: Improper Input Validation

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Cisco ASA Improper Input Validation (CVE-2019-1697)

A vulnerability in the implementation of the Lightweight Directory Access Protocol LDAP feature in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial ...

Cisco ASA Improper Input Validation (CVE-2019-1687)

A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a denial of service DoS condition. The...

CVE-2026-105687: Improper Privilege Management

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2026-94645

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-90440

Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85086

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...