CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

CVE-2026-80218

AshAuthentication (by team-alembic ) is vulnerable to Improper Authentication : a sign-in token issued for one resource can be accepted by another. The root cause is that extract_primary_keys_from_subject/2 parses the JWT sub claim with URI.parse/1 and retains only the query string, discarding th...

CVE-2026-89064

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

EUVD-2026-81315

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064

All-in-One WP Migration and Backup for WordPress (≤ 7.110 ) contains an unauthenticated Insufficient Credential Protection flaw discovered by Jakub Herman. The Ai1wm_Main_Controller::init() method, registered on the admin_init hook, reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from...

EUVD-2026-81285

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

PT-2026-94292

Name of the Vulnerable Software and Affected Versions ash authentication phoenix versions 1.7.0 through 2.17.3 ash authentication phoenix versions 3.0.0-rc.0 through 3.0.0-rc.10 ash authentication versions 3.10.5 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Descriptio...

PT-2026-95161

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.10.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An authentication bypass by spoofing allows an attacker to replace a victim's authenticated session with their own account...

PT-2026-95162

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.2.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description A session fixation issue allows an attacker to maintain an authenticated session if they can plant a session identifier in ...

PT-2026-94543

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On RV64, the Application Binary Interface ABI requires sign-extension for signed 1-byte and 2-byte kfunc arguments. The RV64 Just-In-Time JIT compiler fails to perform this sign-extensio...

CVE-2026-93067: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

CVE-2026-92943: Improper Validation of Certificate with Host Mismatch

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

PT-2026-94289

Name of the Vulnerable Software and Affected Versions ash authentication versions 3.10.5 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Improper authentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user o...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

PT-2026-94137

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...

CVE-2026-93394: Incorrect Implementation of Authentication Algorithm

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

PT-2026-95111

Name of the Vulnerable Software and Affected Versions libmongoc affected versions not specified Description A flaw in the SCRAM authentication implementation allows a man-in-the-middle attacker to inject a crafted server-first-message with a controlled salt and low iteration count. Because the...

DEBIAN-CVE-2026-75516

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...