OptixGate

Optix Gate is a multi-purpose secure remote administration tool for Microsoft Windows. It provides remote access to multiple Windows sessions and/or machines simultaneously. History Optix Gate was created, among other things, to maintain and further develop my Windows application programming...

Linux Distros Unpatched Vulnerability : CVE-2026-88017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy drive...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

PT-2026-89689

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85094

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-85094

Canva Android App versions prior to 2.376.0 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . An attacker who gains control of the WebView could read those headers and access a user's session . The CVSS 3.1 score is 8.8 (HIGH) , with a network vector...

EUVD-2026-70914

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...

PT-2026-85426

Name of the Vulnerable Software and Affected Versions Canva Android App versions prior to 2.376.0 Description The application failed to restrict headers returned to an external origin operating within a privileged WebView. A WebView is a system component that allows Android apps to display web...

PT-2026-85425

Name of the Vulnerable Software and Affected Versions Canva Android versions prior to 2.376.0 Description An issue exists where an external origin can be loaded within a privileged WebView, a component used to display web content inside a native application. This failure in the origin trust...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

PT-2026-84986

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.0 Description An authentication failure exists where the video id hash acts as a non-expiring and non-revocable bearer token. A bearer token is a security token that grants access to whoever possesses it. This...

CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

Malicious code in ranux-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev...

CVE-2026-73037

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-37171

CVE-2026-37171 affects SuperTokens Core, versions 6.0.0 to 11.4.0. The root cause is a lack of tenant separation, enabling an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. The CVSS 3.1 base score is 5.9 (Medium) with vectors: AV:N/AC:H/PR:L/UI:N/S:U/...

NPM: Electron: Extension tab APIs operate across session boundaries

NPM: Electron: Extension tab APIs operate across session boundaries vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

Exposure of Data Element to Wrong Session

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scope...

GHSA-M55F-7GQJ-FR98 Electron: Extension tab APIs operate across session boundaries

Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...