EUVD-2026-81032

OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolati...

CVE-2026-92764: Incorrect Authorization

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

CVE-2026-18025

Insufficient Moodle app token isolation made it possible for a Moodle site being logged into the app to access secure-storage tokens for other Moodle sites the user already had configured in their Moodle mobile app. This could result in compromise of the user’s web service token if, for example,...

Can AI Keep a Secret? Contextual Integrity Verification: a Provable Security Architecture for LLMs

Large language models LLMs remain acutely vulnerable to prompt injection and related jailbreak attacks; heuristic guardrails rules, filters, LLM judges are routinely bypassed. We present Contextual Integrity Verification CIV, an inference-time security architecture that attaches cryptographically...

Access Token Leakage

Duende.AccessTokenManagement.OpenIdConnect is vulnerable to access token leakage. The vulnerability is due to improper token isolation within the HTTP client pool, where a refreshed access token is not properly isolated and may be captured by pooled HttpClient instances, allowing an attacker to...