CVE-2026-78553

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

EUVD-2026-65119

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant,...

EUVD-2026-63564

django CMS: Page cache ignores plugin-declared Vary headers disclosure & poisoning...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the removeProfileImage process. An attacker can remove another user's profile image without authorization by sending a crafted DELETE request with the target user's identifier...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the removeProfileImage process. An attacker can remove another user's profile image without authorization by sending a crafted DELETE request with the target user's identifier...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

EUVD-2026-65089

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-78417

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

Malicious code in secret-key-totp (npm)

Source: amazon-inspector 0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6 [email protected] declares a postinstall hook node./index.js --setup that executes a credential stealer and dropper on install, and the same routine also fires when the library API e.g. validateSecret is...

CVE-2026-78417

The IronVNC client within Devolutions Remote Desktop Manager is vulnerable to an insufficient verification of data authenticity (CVE-2026-78417). This flaw allows an on-path attacker to intercept and tamper with VNC sessions because the client automatically accepts the server's RSA key during RSA...