ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body Description Etherpad ships an endpoint pair under /tokenTransfer src/node/hooks/express/tokenTransfer.ts that lets a logged-in user move their...

CVE-2026-65945

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55246

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945

Apache Ranger is affected by CVE-2026-65945 where logs contain replayable JWT tokens in versions

CVE-2026-65945 Apache Ranger: Logs contain replayable JWT bearer tokens

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

UBUNTU-CVE-2026-64597

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2close replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2closeinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-45377

CVE-2026-45377 affects Decidim where the normal download_your_data flow authenticates the export owner but redirects to a signed Active Storage blob URL that is not bound to the owner session. This allows replay of the redirect URL by anyone who obtains it, enabling access to private exports. Aff...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

Decidim - Private exports can be downloaded through reusable links

Description The normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Impact Personal data exports can be retrieved through leakage channels such ...

PT-2026-56281

Name of the Vulnerable Software and Affected Versions Fire-Boltt Smartwatch FB BGS001 version MOY-JS14-2.0.4 Description Improper authentication allows the device to accept GATT Write Request commands without sufficient authentication or strong session validation. This enables a nearby device to...

GO-2026-5273 MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

OpenBao suffers from an unspecified vulnerability (CNVD-2025-18607)

OpenBao is OpenBao open source a sensitive data management software . A security vulnerability exists in OpenBao versions 0.1.0 through 2.3.1, which stems from the TOTP key engine being able to accept valid code multiple times, and no details of the vulnerability are provided at this time...

Malwarebytes: Replayable Password Change Request Across Sessions.

Vulnerability description not provided...

PT-2025-37964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential inconsistent update of the reference count was identified in the smb2 compound op function. This inconsistency could lead to resource leaks. The issue arises because the...

Replayable signature in the mintReceipt function

Lines of code Vulnerability details Description In the mintReceipt function there is a check of the claimSignerAddress signature: if keccak256abi.encodePackedmsg.sender, questId != hash revert InvalidHash; if recoverSignerhash, signature != claimSignerAddress revert AddressNotSigned; The signatur...