CVE-2026-19600

Mattermost versions 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , 11.7.x <= 11.7.10 , and 11.10.x

CVE-2026-95686

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin Cross-Organization Resource Authentication Bypass Proof-of-concept for CVE-2026-72001 , a broken-object-level-authorization flaw in Pangolin 1.22.0 that lets the holder of one resource share link mint a valid resource session for any other resource on the instance...

CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

nuclei-CVE-2025-24813

nuclei-CVE-2025-24813 This repository contains a yaml-template, to scan whether a Service may be vulnerable to CVE-2025-24813, without disrupting the server/causing any form of damage, using the vulnerability scanner nuclei. CVE-2025-24813 CVE-2025-24813 is a vulnerability in the Apache Tomcat...

EUVD-2026-102522

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

EUVD-2026-102475

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...

PT-2026-116178

Name of the Vulnerable Software and Affected Versions Mage OSS versions prior to 0.9.80 commit 76c4f46 Description The software allows session creation to proceed even when an unknown OAuth provider is encountered. OAuth Open Authorization is a standard that allows a website or application to...

PT-2026-116035

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant demo' to gain full...

PT-2026-116040

Name of the Vulnerable Software and Affected Versions FastapiAdmin versions prior to 3.1 Description An authentication bypass allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via the...

PT-2026-116160

Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.56.0 Description Cross-site request forgery is possible via the unauthenticated GET '/auth/telegram' loopback callback. The telegram auth handler function processes an attacker-supplied one-time Telegram login tok...

PT-2026-116091

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

CVE-2026-19864

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...

FreeBSD : nginx -- multiple vulnerabilities (95970257-c867-11f1-9006-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 95970257-c867-11f1-9006-3497f65b111b advisory. The nginx developers report: A buffer overflow might occur in a worker process when using the...

SUSE CVE-2026-84471

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

vertx-web-xsrf

Overview The CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl in Vert.x Web does not create CSRF Tokens that are unique per user session. A malicious website can still perform CSRF by obtaining a valid CSRF token and adding it to a HTML form and then submitting the form to the...

CVE-2025-8730

CVE-2025-8730 – Authentication Bypass in Belkin F9K1009/F9K1010 Author : Byte Reaper Description : This repository contains a exploit for CVE‑2025‑8730, a critical Authentication Bypass vulnerability affecting the web interface of Belkin F9K1009 and F9K1010 routers. The flaw lies in the session...

SUSE CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

SUSE CVE-2026-110809

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.createreq of the file python/sglang/srt/session/sessioncontroller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be...