EUVD-2026-103290

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read t...

CVE-2026-111922

Vikunja versions 2.2.0 before 2.7.0 are vulnerable to a permissive CORS configuration that trusts all localhost and 127.0.0.1 ports with credentials, regardless of the service.publicurl setting. An attacker who controls a page on any localhost port can perform a credentialed request to the token ...

EUVD-2026-54172

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

CVE-2026-70636 Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

CVE-2026-70478

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-70478 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-70478

Summary of CVE-2026-70478 (Flowise) : The unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is exposed via WHITELIST_URLS and decrypts the stored credential to perform an OAuth token refresh, returning a new access_token in the response. An attacker with a valid creden...

CVE-2026-70478 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-17580

The CVE concerns the WordPress plugin Advanced Views (Display Custom Fields) versions up to and including 3.9.1. It exposes sensitive content via REST endpoints register_rest_routes (view-refresh and card-refresh), where an authenticated user with subscriber-level access or higher can access admi...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

PT-2026-61826

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-1239 Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for...

EUVD-2026-40913

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for...

PT-2026-42676

Name of the Vulnerable Software and Affected Versions NocoDB affected versions not specified Description The refresh-token cookie is configured with httpOnly: true but lacks the secure flag and the sameSite attribute. The absence of the secure flag allows the cookie to be intercepted over plain...

GHSA-5F5R-95PG-XRPM Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

Summary Some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15...

CVE-2026-4874

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery SSRF by manipulating the clientsessionhost parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host...

CVE-2026-1195

A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The attack is considered ...

CVE-2026-1195 MineAdmin JWT Token refresh data authenticity

A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The attack is considered ...

CVE-2026-1195

Summary: CVE-2026-1195 affects MineAdmin 1.x/2.x, specifically the JWT Token Handler’s /system/refresh function. The issue is insufficient verification of data authenticity, enabling a remote attack with high complexity; exploitation has been publicly disclosed. Multiple sources consistently desc...