CVE-2026-65616

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

PT-2026-65106

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

GO-2026-5885 Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go...

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

CVE-2026-16798

The vulnerability CVE-2026-16798 affects Devolutions PowerShell Universal (automation jobs API) up to version 2026.2.2. The underlying issue is that job read responses fail to strip a user’s stored OAuth refresh token, allowing an authenticated user with scoped job or script read permission to ac...

EUVD-2026-48605

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

SUSE CVE-2026-52684

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

PT-2026-64307

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description The automation jobs API contains a flaw where sensitive information is included in sent data. An authenticated user with scoped job or script read permissions can obtain...

CVE-2026-15967

Issue: Insufficient session expiration in Progress MOVEit Transfer. Affected versions: MOVEit Transfer before 2025.1.5, and 2026.0.0 before 2026.0.3 (i.e., 2026.0.0–2026.0.2). Root cause: Sessions do not expire sufficiently, potentially allowing continued access to active sessions. Impact: High i...

CVE-2026-15967 MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

PYSEC-2026-3467 garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...

CVE-2026-52684

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

EUVD-2026-47932

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

GHSA-VRHC-JJFC-M3M3 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account IsActive=false when the user signs in through an authentication source that does not issue refresh tokens notably GitHub, and any OIDC/OAuth2 source configured without offlineaccess. PR 38009 added a gate intended ...

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...

SUSE-SU-2026:22650-1 Security update for helm

This update for helm fixes the following issue - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens bsc1270127. Changes for helm: - Update to version 3.21.2...

CVE-2026-13439

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...