PT-2026-97402

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

CVE-2026-75886: Unintended Proxy or Intermediary

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

PT-2026-97594

Name of the Vulnerable Software and Affected Versions openshift/console affected versions not specified Description A misconfiguration in the CatalogdHandler allows an unauthenticated remote attacker to bypass authentication. By leveraging the forwarding of the openshift-session-token cookie, an...

CVE-2026-80154

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

CVE-2026-80154

CVE-2026-80154 affects all firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 . The vulnerability resides in the web management portal , where session tokens are generated deterministically from the device model and current time at one-second resolution , yield...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

EUVD-2026-84520

All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

CVE-2026-46649

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

CVE-2026-46649 Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

EUVD-2026-84171

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

CVE-2026-46649

Joplin Server , the backend for the open-source note-taking application Joplin, is vulnerable to a brute-force attack on SSO authentication codes prior to version 3.7.2 . The root cause is that the GET /api/login_with_code/:id endpoint accepts a nine-digit SSO code with a ten-minute lifetime with...

CVE-2026-63373 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-63373 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-63373

draw.io prior to version 30.2.7 contains an OAuth CSRF vulnerability in its callback handler (AbsAuth.java) that skips the stateToken/cookieToken comparison when IS_GAE is false, affecting self-hosted Docker and WAR deployments . An attacker can inject their own authorization code into a victim's...

CVE-2026-63373 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-46649: Improper Restriction of Excessive Authentication Attempts

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

PT-2026-96121

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2 Description The Core API logout endpoint only revokes session tokens provided via the token cookie. If a client uses an Authorization bearer header for authentication during logout, the endpoint returns a...

PT-2026-96274

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description The GET '/api/login with code/:id' endpoint fails to apply the limiterLoginBruteForce mechanism when processing nine-digit SSO authentication codes. This allows an unauthenticated attacker to...

CVE-2026-45720

Omni (by Sidero Labs), a platform for managing Kubernetes on bare metal, VMs, or cloud, contains a TOCTOU race condition in SAML.getSession (internal/pkg/auth/interceptor/saml.go). The Used flag on a SAMLAssertion is checked and marked in two separate non-atomic operations, allowing concurrent re...