CVE-2026-3432

On SimStudio version below to 0.5.74, the /api/auth/oauth/token endpoint contains a code path that bypasses all authorization checks when provided with credentialAccountUserId and providerId parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their...

Puppet CD4PE 安全漏洞

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. An access control error...