CVE-2026-66884

The CVE-2026-66884 affects oidcc_plug (Oidcc.Plug.AuthorizationCallback.call/2) in Erlang Ecosystem Foundation. A callback with no Oidcc.Plug.Authorize session is processed with security checks disabled, causing nonce, state, PKCE, IP and user-agent checks to be skipped and permitting state-less ...

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465 Session Fixation in Bilin Software's HUMANIST Digital Human Resources

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52654

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

CVE-2026-14465 : Insufficient session expiration allowing session ID reuse (session fixation) in Bilin Software’s HUMANIST Digital Human Resources. Affects versions from 26.0 up to, but not including, 26.1. Impact: potential for session replay with high confidentiality risk; no impact to integrit...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14838

CVE-2026-14838 affects HUMANIST Digital Human Resources from Bilin Software and Informatics Consultancy Inc. (versions 26.0 up to, but not including, 26.1). The vulnerability arises from using GET requests with sensitive query strings, enabling session exposure and potential account takeover. The...

EUVD-2026-52652

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14838 Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52594

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

EUVD-2026-52564

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846

Node.js HTTP/2 handling flaw (CVE-2026-56846) affects Node.js 24.x and 22.x. The issue allows HTTP/2 retained header blocks to evade maxSessionMemory, enabling remote memory exhaustion. Exploitation details are not provided in the documents. Remediation follows the vendor advisory: apply the July...

EUVD-2026-52487

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

EUVD-2026-52486

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...