CVE-2026-77812

CVE-2026-77812 — DJI Drone Cleartext BLE Transmission of Wi-Fi PSK and Session UUID POC CVE record: https://vulners.com/cve/CVE-2026-77812 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77812 Description DJI Drone expose a DUML control channel over Bluetooth. Every message on that channel — in bo...

CVE-2026-104875

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

PT-2026-111969

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875: Authorization Bypass Through User-Controlled Key

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

EUVD-2026-92714

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695: Missing Authorization

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

PT-2026-106216

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists where the assemble-chunks endpoint retrieves an upload session using only its session ID, failing to scope the lookup to the authenticated profile as the upload-chunk endpoint does. A...

Exploit for CVE-2026-77812

CVE-2026-77812 — DJI Cleartext BLE Transmission of Wi-Fi PSK a...

User Impersonation

keycloak-services is vulnerable to User Impersonation. The vulnerability is due to the OpenID Connect user authentication because the session UUID is not properly bound to the user session, allowing an attacker to obtain a certain piece of information from a user request in the same realm and...