CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-80184

OpenStack Keystone versions before 29.0.3 are affected by a project-scope escape vulnerability in the token-method authentication path. Tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, or trusts) can be submitted for reauthentication and, whe...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-76197

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76193

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-76195

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76195 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

EUVD-2026-65619

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

EUVD-2026-65618

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76197 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76197 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76193 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-76193 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-76193

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that can lead to arbitrary code execution in the context of the current user. Exploitation requires no user interaction and has a changed scope , reflected in a CVSS 3.1 score of 10.0 (Critica...

CVE-2026-76197

Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability (CWE-78) that could allow an attacker to achieve arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and the scope is changed, meaning the vulnerable componen...