219 matches found
CVE-2026-28361 NocoDB: Missing Ownership Validation in MCP Token Operations
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in...
EUVD-2026-9210
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in...
PT-2026-22632
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in...
CVE-2026-26016 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance,...
Wings 安全漏洞
Wings is the server control interface for Pterodactyl Panel. Versions of Wings prior to 1.12.1 contained security vulnerabilities. These vulnerabilities stemmed from the lack of authorization checks in multiple controllers, which could allow node token holders to access information about any serv...
The vulnerability of the endpoint /api-selfportal/get-info-token-properties of the Secure Authentication Server software allows a attacker to perform a brute-force attack and gain unauthorized access to user tokens.
The vulnerability of the endpoint /api-selfportal/get-info-token-properties of the Secure Authentication Server software relates to the authentication process, which involves the use of a key controlled by the user. Exploiting this vulnerability could allow an attacker to perform a brute-force...
CVE-2021-28490
In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...
CVE-2020-12613
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the security token prior to Avecto elevation. When Avecto elevates the process, it removes the user who is launching the process, but not the second...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to mishandling access control to private resources. An attacker can gain unauthorized access to private resources by using an API token that is restricted to public resources. Remediation Upgrade...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to mishandling access control to private resources. An attacker can gain unauthorized access to private resources by using an API token that is restricted to public resources. Remediation Upgrade...
Dynatrace OneAgent 安全漏洞
Dynatrace OneAgent is an intelligent agent program from Dynatrace, Inc. A security vulnerability exists in Dynatrace OneAgent versions prior to 1.325.47, which stems from the fact that the agent retrieves every user token on a machine and attempts to access a network share when it receives a...
About the security content of visionOS 26.2
About the security content of visionOS 26.2 This document describes the security content of visionOS 26.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
CVE-2025-63563
The Summer Pearl Group Vacation Rental Management Platform (versions prior to v1.0.2 ) contains a security vulnerability where it fails to properly invalidate active user sessions following a password change. This flaw allows an attacker who possesses a valid session token to maintain persistent ...
CVE-2025-49594
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
EUVD-2013-3642
Malware in sbrugna...
EUVD-2018-7620
Malware in sbrugna...
EUVD-2021-2354
Malware in sbrugna...
EUVD-2019-10130
Malware in sbrugna...