22 matches found
BoxPwnr-Traces
BoxPwnr-Traces BoxPwnr traces and benchmark results across multiple security platforms. Each trace includes the full LLM interaction, commands executed, a markdown report + attack graph, stats and config used. Browse leaderboards, replay runs in an interactive web viewer, and read AI-generated...
CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body Description Etherpad ships an endpoint pair under /tokenTransfer src/node/hooks/express/tokenTransfer.ts that lets a logged-in user move their...
CVE-2026-65945
Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
EUVD-2026-55246
Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-65945
Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-65945
Apache Ranger versions
CVE-2026-65945 Apache Ranger: Logs contain replayable JWT bearer tokens
Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
UBUNTU-CVE-2026-64597
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2close replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2closeinit fails before the next send, cleanup retains the previous buffer type and fre...
PT-2026-68430
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt can return a replayable error and free its response buffer. If the SMB2 close init function fails before the...
CVE-2026-45377
CVE-2026-45377 affects Decidim where the normal download_your_data flow authenticates the export owner but redirects to a signed Active Storage blob URL that is not bound to the owner session. This allows replay of the redirect URL by anyone who obtains it, enabling access to private exports. Aff...
CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...
CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...
Decidim - Private exports can be downloaded through reusable links
Description The normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Impact Personal data exports can be retrieved through leakage channels such ...
PT-2026-56281
Name of the Vulnerable Software and Affected Versions Fire-Boltt Smartwatch FB BGS001 version MOY-JS14-2.0.4 Description Improper authentication allows the device to accept GATT Write Request commands without sufficient authentication or strong session validation. This enables a nearby device to...
GO-2026-5273 MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry...
CVE-2026-42602
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...
CVE-2026-42602
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...
OpenBao suffers from an unspecified vulnerability (CNVD-2025-18607)
OpenBao is OpenBao open source a sensitive data management software . A security vulnerability exists in OpenBao versions 0.1.0 through 2.3.1, which stems from the TOTP key engine being able to accept valid code multiple times, and no details of the vulnerability are provided at this time...
