EUVD-2026-122422

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally...

CVE-2026-119816

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally...

CVE-2026-119921

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally...

CVE-2026-119816

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally...

EUVD-2026-122337

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally...

EUVD-2026-121241

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTHSECRET. Attackers can enumerate registered e-mails via /api/auth/signin, forge HS256 JWTs redeemed by...

CVE-2026-120999

The nerves-hub nerves_hub_web component (versions 2.3.0 before 2.5.3 ) is vulnerable to an Improper Authentication flaw in its Google sign-in and email confirmation workflows. The root cause is that NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs in Google users to any existing ac...

PT-2026-141754

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH SECRET. Attackers can enumerate registered e-mails via /api/ auth/signin, forge HS256 JWTs redeemed by /api/...

⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More

A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside...

CVE-2026-17297

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent ...

CVE-2026-17291

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authenticatio...

EUVD-2026-118752

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's o...

EUVD-2026-118689

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent ...

CVE-2026-17291

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to an open redirect vulnerability. The root cause is insufficient validation of the redirect address during OAuth 2.0 sign-in , which may allow a remote authenticated attacker to perform account takeo...

EUVD-2026-118683

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authenticatio...

CVE-2026-123283

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

EUVD-2026-118048

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

CVE-2026-123283

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

CVE-2026-123283

In JetBrains Datalore versions prior to 2026.4 , an account takeover vulnerability exists. The root cause is Improper Session Invalidation (CWE-1464) occurring during SSO sign-in to a pre-registered account. This flaw allows an attacker to potentially seize control of a user account. While the ba...

CVE-2026-123283: JetBrains Datalore: In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...