CVE-2026-75554

CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

CVE-2026-72714

Rocq Prover (through 9.2.0) contains a state desynchronization in its universe checking mechanism. When a module that locally disabled the universe checking flag is closed, the global flag is restored but the universe graph retains its own copy left disabled . The kernel then accepts universe-inc...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

EUVD-2026-64293

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

CVE-2026-75866

Punk::OAuth2::Server (Perl module) versions through 0.03 are affected by an authorization bypass in its OAuth2 token issuance. The token endpoint dispatches on the grant_type from the request body without validating it against the client's registered grant types, and the authorize endpoint copies...

EUVD-2026-63994

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-67567

CVE-2026-67567 is a CRITICAL (CVSS 9.9) privilege escalation vulnerability in the multicloud-operators-subscription Kubernetes operator. The HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper GVK or namespace restriction , allowin...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

EUVD-2026-63484

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...

CVE-2026-54136 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...

CVE-2026-54136 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...

CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

EUVD-2026-63465

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-55095

In OpenProject ≤17.5.1, the inplace-edit dialog resolves project custom fields by raw identifier without enforcing the admin_only visibility scope, leaking hidden admin-only comment text to authenticated non-admin members. CVSS 5.3 MEDIUM. Fixed in 17.6.0. No public exploitation observed.

CVE-2026-56654

A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...