16967 matches found
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...
EUVD-2026-51848
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...
CVE-2026-67304 FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...
7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran
Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed...
CVE-2026-11882
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...
CVE-2026-11882
Builderall for WordPress plugin prior to version 3.0.2 contains an OAuth state handling flaw: it does not bind the OAuth flow state to the initiating user session, enabling unauthenticated attackers to finish the connection flow and overwrite the stored third‑party integration access token. A dur...
CVE-2026-12966 Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions
The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with othe...
CVE-2026-28145
Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...
EUVD-2026-51536
Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39...
CVE-2026-28145
The CVE-2026-28145 entry identifies a broken access control vulnerability in the WordPress plugin MasterStudy LMS (StylemixThemes) affecting versions up to 3.7.39. The issue is described as Insufficient Verification of Data Authenticity, allowing an attacker to manipulate a user’s state. Public r...
The vulnerability of the __cdns3_gadget_init() function in the drivers/usb/cdns3/cdns3-gadget.c driver for Linux device drivers allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the cdns3gadgetinit function in the drivers/usb/cdns3/cdns3-gadget.c driver for Linux USB device drivers is related to an incorrect definition of internal states. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...
CVE-2026-17760
A side-channel information leakage flaw was found in the NoStatePrefetch component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=506473189...
CVE-2026-13379
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
SUSE CVE-2026-46403
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...
SUSE CVE-2026-53935
Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespa...
SUSE CVE-2026-55883
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websockettoken endpoint and the upgrader accepts clients that omit an Origin...
SUSE CVE-2026-55884
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can...
EUVD-2026-50563
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion Unbounded Map Growth...
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
Summary OliveTin's OAuth2 login handler stores per-login state in an in-memory map registeredStates that grows unboundedly. States are added on every /oauth/login request but are never deleted or expired. An unauthenticated attacker can send millions of requests to /oauth/login to fill the map wi...