CVE-2026-12715

CVE-2026-12715 describes a missing authorization flaw in Google Cloud Firebase Studio for versions prior to 2026-04-15, enabling an attacker to download other users’ deployed source code and access sensitive data via unauthorized Google Cloud Storage URL signing requests. The issue has a high imp...

CVE-2026-12715 Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft

Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...

CVE-2026-63094 SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

EUVD-2026-45177

SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with...

CVE-2026-63094 SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-63094

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-63094 SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-63094

SigNoz up to version 0.133.0 contains an open redirect in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC. An attacker can call the unauthenticated sessions context endpoint with a ref pa...

CVE-2026-16089

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to the OAuth 2.0 authorization code handling. An attacke...

SAP NetWeaver AS ABAP BSP XSS (3754659)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3754659: - Due to a Cross-Site Scripting XSS vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application...

SAP NetWeaver Enterprise Portal XSS (3746678)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...

CVE-2026-44181

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables KERNELXXX used during the rendering of the Kubernetes manifest are vulnerable ...

CVE-2026-44181 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables KERNELXXX used during the rendering of the Kubernetes manifest are vulnerable ...

CVE-2026-63089

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as...

MAL-2026-10737 Malicious code in mmagrt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7eddaa3f964de5ebd63c3272f8abe021b60402b5fde4d4437cc254c99a8211a The npm package advertises itself as a 'VPS routine scheduler' but ships prebuilt Rust binaries mmagrt and mmagrt-mcp for darwin-arm64, darwin-x64,...

maganghub-cors-poc

CORS PoC - MagangHub Proof of Concept f...

MAL-2026-10748 Malicious code in string-formatter-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 966ebbfb039acea9e1f98c5f74f13e2aab1617e371719bc9543315702dbd67cd The package advertises itself as a string-formatting utility whose main module exports only a trivial one-line capitalize function, but ships a...

CVE-2026-46513 Frogman: API tokens stored in plaintext

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hexrandombytes32 strings in ocapitokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stor...

CVE-2026-12379

CVE-2026-12379 is an open redirect vulnerability in the Axivion Dashboard’s OAuth/OIDC login flow. The post-authentication redirect is not restricted to the application’s own origin, allowing an attacker to craft a login link that, after authentication, redirects the user to an untrusted external...