2969 matches found
CVE-2026-78426
NeuVector 's JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid, non-expired JWT that was already used to log out of NeuVector can continue using the token by altering the spelling of the signature field, bypassing the logout mechani...
CVE-2026-78426 Logout bypass via alternate JWT spelling
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...
CVE-2026-78426 Logout bypass via alternate JWT spelling
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...
EUVD-2026-81279
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
PT-2026-94202
Name of the Vulnerable Software and Affected Versions NeuVector affected versions not specified Description The JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. This allows an attacker who possesses a valid, non-expired JWT to bypass the logout mechanism by...
CVE-2026-92579
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
CVE-2026-92579
AVideo through version 29.0 is affected by a broken access control flaw in its autoCSRFGuard() function. The function maintains a hardcoded allowlist of exempt basenames that are tested without directory context, meaning plugin files whose filenames match core filenames inadvertently inherit CSRF...
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...
CVE-2026-92793 GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...
CVE-2026-92793 GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...
EUVD-2026-81056
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...
CVE-2026-92793 GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...
CVE-2026-92793
GoAdmin (through version 1.2.26 ) contains an authorization bypass in its permission-checking middleware. The root cause is a failure to properly anchor the logout pattern when validating permissions, allowing any authenticated user to append a query parameter containing the admin prefix followed...
CVE-2026-59570
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
CVE-2026-59570
CVE-2026-59570 affects Zscaler Client Connector (ZCC) on Android , where a pre-installed peer application can tear down the Zscaler tunnel, force a user logout, and toggle packet capture. The primary impact is denial of service (tunnel disruption and forced logout), with additional integrity impa...
CVE-2026-59570 Android ZCC denial of service
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
EUVD-2026-77540
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: During vport deletion, an explicit async logout operation is required. During vport deletion, it was observed that an crash occurred due to stale entries in the outstanding command array. For all these stale I/O...