the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

DEBIAN-CVE-2026-96545

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

EUVD-2026-85539

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

CVE-2026-65013-BOLA-IDOR

CVE-2026-65013-BOLA-IDOR PoC reproducible deBOLA / IDOR en la API tRPC de Onlook CVE-2026-65013. Cualquier usuario autenticado puede leer, modificar y borrar proyectos, miembros e historial de IA de otros usuarios con solo pasar sus UUID a los procedimientos tRPC versiones = 0.2.32. | ---|--- CVE...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2023-002897)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002897 advisory. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. ...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-59982

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted deep EXR image file, which, when processed by a user, could lead to an out-of-bounds pointer being returned by the TypedDeepImageChannel::row function. This vulnerability could cause the application to crash Denial o...

CVE-2026-59189

A flaw was found in OpenEXR. An attacker could provide a specially crafted deep image that, when processed, would cause an out-of-bounds read in the TypedDeepImageChannel::row API if the image has a non-zero dataWindow origin. This vulnerability can lead to a heap out-of-bounds read, resulting in...

CVE-2026-59981

A flaw was found in OpenEXR. An attacker can craft a malicious deep EXR image file that, when opened by an application, can lead to an out-of-bounds read in the OpenEXRUtil library's SampleCountChannel::row API. This vulnerability can result in information disclosure, where adjacent heap memory i...

CVE-2026-77239

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-77239 WACRM: Service-role routes missing a role check

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

EUVD-2026-83178

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-77239 WACRM: Service-role routes missing a role check

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-77240 WACRM: Database-layer authorization bypasses

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profilesupdate row-level security policy in supabase/migrations/017accountsharing.sql permits authenticated users to modify their own accountrole and accountid, allowing a viewer to self-promote or move into...

CVE-2026-77239: Improper Authorization

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

EUVD-2026-82409

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

CVE-2026-90997

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

EUVD-2026-82396

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-90997 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...