CVE-2026-117468

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session...

CVE-2026-117468

Psono Server versions 5.3.5 through 7.2.3 are vulnerable to a restricted token escalation due to a permission class that fails to enforce token write scope when claiming a device code. An authenticated remote attacker with a restricted API key-derived session can claim an attacker-controlled devi...

CVE-2026-117468 Device-code claim permits restricted token escalation in Psono Server

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session...

EUVD-2026-110600

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session...

EUVD-2021-31345

Malicious code in bioql PyPI...

CVE-2021-44512

World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory...