Lucene search
+L

5048 matches found

Cvelist
Cvelist
added 2026/08/16 1:50 p.m.37 views

CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

0.0055EPSS
SaveExploits0References5
Debian CVE
Debian CVE
added 2026/08/16 1:50 p.m.8 views

CVE-2026-72887

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

9.8CVSS5.4AI score0.0055EPSS
SaveExploits0
EUVD
EUVD
added 2026/08/16 1:50 p.m.10 views

EUVD-2026-59987

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

5.3AI score0.0055EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/16 1:50 p.m.44 views

CVE-2026-72887

Net::OAuth::Client (Perl, before 0.32) silently downgrades OAuth 1.0a to OAuth 1.0 in get_request_token when the provider omits oauth_callback_confirmed, dropping oauth_verifier with no warning. This exposes affected applications to OAuth 1.0 session fixation: an attacker obtains a request token,...

9.8CVSS5.4AI score0.0055EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/16 1:50 p.m.7 views

CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

9.8CVSS5.5AI score
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/08/16 6:00 a.m.10 views

CVE-2026-19714

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Log...

5.2AI score0.00324EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/08/16 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2026-72887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback...

9.8CVSS5.4AI score0.0055EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/16 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2026-72888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire. smartrequire stores results in a...

6.5CVSS5.6AI score0.00436EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/15 1:45 p.m.11 views

EUVD-2026-59767

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

4.2CVSS5.3AI score0.00099EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/15 12:00 a.m.13 views

PT-2026-73032

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

4.2CVSS5.3AI score0.00099EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/14 7:42 p.m.7 views

MAL-2026-14047 Malicious code in @guangnao/agent-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...

5.8AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/08/14 7:25 p.m.10 views

OpenAM Insecure SSO Cookie Initialization

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

5.3AI score
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/08/14 3:36 p.m.5 views

GHSA-29RF-F4VV-PVQ6 Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

The OAuth callback handler links incoming OAuth identities Google, GitHub, etc. to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address without verifying it...

8.7CVSS5.6AI score
SaveExploits0References4
Chainguard
Chainguard
added 2026/08/14 8:25 a.m.11 views

GO-2024-2476 vulnerabilities

Vulnerabilities for packages: dex...

5.3AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/14 8:24 a.m.6 views

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: dask-gateway, kafka-proxy, kbld-fips, cfssl, cargobump, authservice-fips, direnv, seaweedfs-operator-fips, cyberark-secrets-provider-for-k8s, istio, protoc-gen-go-grpc, wave, dfc, external-dns-fips, atlantis, teleport, falcoctl-fips, minio-operator-fips, kind,...

5.2AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/14 8:24 a.m.6 views

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: dask-gateway, kafka-proxy, kbld-fips, cfssl, cargobump, authservice-fips, direnv, seaweedfs-operator-fips, cyberark-secrets-provider-for-k8s, istio, protoc-gen-go-grpc, wave, dfc, external-dns-fips, atlantis, teleport, falcoctl-fips, minio-operator-fips, kind,...

5.2AI score
SaveExploits0
NVD
NVD
added 2026/08/13 8:17 p.m.5 views

CVE-2026-73655

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

7.4CVSS0.00362EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/13 7:53 p.m.29 views

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

7.4CVSS0.00362EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/13 7:53 p.m.1 views

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

7.4CVSS5.5AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/08/13 7:53 p.m.6 views

CVE-2026-73655

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

7.4CVSS5.3AI score0.00362EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder